diff --git a/.github/workflows/deploy-docs.yaml b/.github/workflows/deploy-docs.yaml
index e9934218f..fff9de999 100644
--- a/.github/workflows/deploy-docs.yaml
+++ b/.github/workflows/deploy-docs.yaml
@@ -24,7 +24,7 @@ jobs:
     steps:
       # https://github.com/actions/checkout
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0  # otherwise, you will fail to push refs to dest repo
 
diff --git a/.github/workflows/excel_inbox.yaml b/.github/workflows/excel_inbox.yaml
index 3464351be..ecaa18632 100644
--- a/.github/workflows/excel_inbox.yaml
+++ b/.github/workflows/excel_inbox.yaml
@@ -72,7 +72,7 @@ jobs:
       # ── Checkout ─────────────────────────────────────────────────────────────
 
       - name: Check out PR branch (fork-safe)
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           # Contributor's branch — only read here; write-back is in the finish job.
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -88,7 +88,7 @@ jobs:
       - name: Check out main branch into _main_branch/
         # Always run OUR scripts from main — never from the PR.
         # This is the key security boundary for pull_request_target.
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
           path: _main_branch
@@ -206,7 +206,7 @@ jobs:
       - name: Check out main branch
         # Run the test suite against the main-branch project with the modified
         # schema injected from the artifact.
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
           fetch-depth: 1
@@ -267,7 +267,7 @@ jobs:
       # ── Checkout ─────────────────────────────────────────────────────────────
 
       - name: Check out PR branch (fork-safe)
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
@@ -277,7 +277,7 @@ jobs:
           allow-unsafe-pr-checkout: true
 
       - name: Check out main branch into _main_branch/
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: main
           path: _main_branch
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 04749a48e..d3b2f132a 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -36,7 +36,7 @@ jobs:
 
       # https://github.com/actions/checkout
       - name: Check out repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test_pages_build.yaml b/.github/workflows/test_pages_build.yaml
index 9f2f89b70..906598112 100644
--- a/.github/workflows/test_pages_build.yaml
+++ b/.github/workflows/test_pages_build.yaml
@@ -28,7 +28,7 @@ jobs:
     steps:
       # https://github.com/actions/checkout
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/update_excel.yaml b/.github/workflows/update_excel.yaml
index 4f3e8f4d1..b2b292abc 100644
--- a/.github/workflows/update_excel.yaml
+++ b/.github/workflows/update_excel.yaml
@@ -38,7 +38,7 @@ jobs:
     steps:
 
       - name: Check out repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7.0.1
         with:
           # Use a token with write access so the commit push works.
           # GITHUB_TOKEN is sufficient for same-repo pushes.