diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7c4357b8..4b79ad7b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
 
     - name: Install clang-format
       run: |
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
 
     - name: Validate prompt system
       run: ./tools/validate-prompts.sh --ci
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         fetch-depth: 0
 
@@ -109,7 +109,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -201,7 +201,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -298,7 +298,7 @@ jobs:
     continue-on-error: true
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -396,7 +396,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -489,7 +489,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -555,7 +555,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -663,7 +663,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -772,7 +772,7 @@ jobs:
     continue-on-error: true
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -890,7 +890,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -1012,7 +1012,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           submodules: recursive
       - name: Install dependencies
@@ -1170,7 +1170,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           submodules: recursive
       - name: Install dependencies
@@ -1289,7 +1289,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Download all error summaries
         uses: actions/download-artifact@v8
@@ -1317,7 +1317,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Count TODO/FIXME/HACK comments
         id: todo-count-run
         run: |
@@ -1359,7 +1359,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure SparkBuild + SparkInstaller (standalone, no engine)
         shell: bash
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0e95b087..2d4ebcb5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -67,7 +67,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
diff --git a/.github/workflows/loc-counter.yml b/.github/workflows/loc-counter.yml
index acdadbcd..30d9fb76 100644
--- a/.github/workflows/loc-counter.yml
+++ b/.github/workflows/loc-counter.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
 
     - name: Count lines of code
       id: loc
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1aee8224..f5ce0795 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,7 +85,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -126,7 +126,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         submodules: recursive
 
@@ -193,7 +193,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Configure SparkBuild + SparkInstaller (standalone)
         shell: bash
@@ -241,7 +241,7 @@ jobs:
 
     steps:
     - name: Checkout release source
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         ref: ${{ github.sha }}
         fetch-depth: 0
@@ -250,7 +250,7 @@ jobs:
     # separate checkout keeps release tags immutable and preserves the exact
     # source checkout used by the release metadata below.
     - name: Checkout canonical badge branch
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         ref: Working
         path: badge-repository
diff --git a/.github/workflows/site-data-publish.yml b/.github/workflows/site-data-publish.yml
index 3975d32e..9201291c 100644
--- a/.github/workflows/site-data-publish.yml
+++ b/.github/workflows/site-data-publish.yml
@@ -113,7 +113,7 @@ jobs:
           printf 'conclusion=%s\n' "$NORMALIZED_CONCLUSION" >> "$GITHUB_OUTPUT"
 
       - name: Checkout the evaluated source commit without persisted credentials
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.SOURCE_COMMIT }}
           fetch-depth: 0
diff --git a/.github/workflows/site-data.yml b/.github/workflows/site-data.yml
index 406d4bc8..c5c063cc 100644
--- a/.github/workflows/site-data.yml
+++ b/.github/workflows/site-data.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout exact source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/summary.yml b/.github/workflows/summary.yml
index a00bd0a3..d63a26ef 100644
--- a/.github/workflows/summary.yml
+++ b/.github/workflows/summary.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Run AI inference
         id: inference
diff --git a/.github/workflows/update-downloads.yml b/.github/workflows/update-downloads.yml
index f94bcfb8..5b44a234 100644
--- a/.github/workflows/update-downloads.yml
+++ b/.github/workflows/update-downloads.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         ref: Working