diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 794bde2a..9f7a812f 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -63,7 +63,7 @@ jobs:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -138,7 +138,7 @@ jobs:
         # Don't fail the check if Claude errors — including hitting the --max-turns cap.
         # A cut-off review writes no verdict line, so the gate step skips it silently.
         continue-on-error: true
-        uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1
+        uses: anthropics/claude-code-action@fa7e2f0a29a126f0b81cdcf360561b36e44cf608 # v1
         with:
           # OAuth token (Pro/Max subscription) is preferred; the API key also works.
           # Whichever secret is unset resolves to an empty string and is ignored.
diff --git a/.github/workflows/auto-assign.yml b/.github/workflows/auto-assign.yml
index 182cffe3..e10ca6a4 100644
--- a/.github/workflows/auto-assign.yml
+++ b/.github/workflows/auto-assign.yml
@@ -38,7 +38,7 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository
     steps:
       # Only the CODEOWNERS file is needed; sparse-checkout keeps it cheap.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .github/CODEOWNERS
diff --git a/.github/workflows/ci-sdk-python.yml b/.github/workflows/ci-sdk-python.yml
index b4eec1ed..06d3a81b 100644
--- a/.github/workflows/ci-sdk-python.yml
+++ b/.github/workflows/ci-sdk-python.yml
@@ -33,7 +33,7 @@ jobs:
       run:
         working-directory: sdks/python
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f79abb5..1964c698 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
 
   go-sdk-spec-sync:
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # The Go SDK lives in a separate repo, so its route-coverage ratchet validates against a VENDORED copy
       # of this spec (webhook-go testdata/openapi.json). A derived artifact whose guard is not triggered by
       # its SOURCE rots silently — exactly how the Python SDK's generated models fell 12 schemas behind
@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: 20
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # The unit suite imports from src/. That proves the CODE works and NOTHING about what users install:
       # a broken `exports` map, a file missing from `files:`, or a bad `types` path all ship green because no
@@ -73,7 +73,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # CLIENT_LATEST (packages/shared/src/client-advisory.ts) is what the API compares a client's
       # User-Agent against to decide whether to advise an update. It is a DERIVED fact — the truth lives in
@@ -90,7 +90,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # `wbhk` ships via npm AND Homebrew, and they can silently diverge: release-cli publishes npm
       # immediately but leaves the GitHub release as a DRAFT (a deliberate human gate), while homebrew-bump
@@ -105,7 +105,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm lint
 
@@ -115,7 +115,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm format:check
 
@@ -125,7 +125,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm typecheck
 
@@ -135,7 +135,7 @@ jobs:
     timeout-minutes: 30
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Coverage thresholds are enforced inside the Vitest config (see packages/shared).
       - run: pnpm test
@@ -166,7 +166,7 @@ jobs:
     env:
       TEST_DATABASE_URL: postgres://postgres@localhost:5432/postgres
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Install dbmate
         env:
@@ -200,7 +200,7 @@ jobs:
     timeout-minutes: 20
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm build
 
@@ -216,7 +216,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Version-pinned, NOT SHA-pinned (unlike the dbmate install above): bun's official installer
       # fetches the version-tagged release, and we don't carry a per-platform archive hash. Deliberate
@@ -278,7 +278,7 @@ jobs:
     timeout-minutes: 20
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm exec turbo run build --filter=@webhook-co/auth
       - run: pnpm -C apps/auth deploy:dry
@@ -293,7 +293,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Unit-test the pure gate helpers (dead-link regex, SEO head rules, sitemap parsing) against
       # fixtures BEFORE the build — a fast fail if the gate logic itself regressed. These node:test
@@ -349,7 +349,7 @@ jobs:
     env:
       TEST_DATABASE_URL: postgres://postgres@localhost:5432/postgres
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Install dbmate
         env:
@@ -373,7 +373,7 @@ jobs:
     timeout-minutes: 30
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm --filter @webhook-co/www build
       - run: pnpm --filter @webhook-co/www exec playwright install --with-deps chromium
@@ -389,7 +389,7 @@ jobs:
     timeout-minutes: 30
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm --filter @webhook-co/www build
       - run: pnpm --filter @webhook-co/www test:lighthouse
@@ -400,7 +400,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm run no-skipped-tests
 
@@ -413,7 +413,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm run tsconfig-boundary
 
@@ -427,7 +427,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - run: pnpm run dal-gate-guard
 
@@ -440,7 +440,7 @@ jobs:
     timeout-minutes: 15
     needs: install
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # npm RETIRED the legacy quick-audit endpoint `pnpm audit` posts to
       # (`/-/npm/v1/security/audits` → HTTP 410), so `pnpm audit` fails every run regardless of
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index eb2125be..539744e6 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -64,14 +64,14 @@ jobs:
             echo "::notice title=Claude not configured::Add CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY in repo Settings to enable @claude mentions."
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.gate.outputs.enabled == 'true'
         with:
           fetch-depth: 0
 
       - name: Claude
         if: steps.gate.outputs.enabled == 'true'
-        uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1
+        uses: anthropics/claude-code-action@fa7e2f0a29a126f0b81cdcf360561b36e44cf608 # v1
         with:
           # OAuth token (Pro/Max subscription) is preferred; the API key also works.
           # Whichever secret is unset resolves to an empty string and is ignored.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4369522b..a8ee8681 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,16 +23,16 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           languages: javascript-typescript
           build-mode: none
           queries: security-extended
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           category: "/language:javascript-typescript"
diff --git a/.github/workflows/deploy-auth.yml b/.github/workflows/deploy-auth.yml
index 5359978d..cb318f84 100644
--- a/.github/workflows/deploy-auth.yml
+++ b/.github/workflows/deploy-auth.yml
@@ -74,7 +74,7 @@ jobs:
       AUTH_DEVICE_KV_ID: ${{ vars.AUTH_DEVICE_KV_ID }}
       AUTH_RATELIMIT_KV_ID: ${{ vars.AUTH_RATELIMIT_KV_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # apps/auth reads the identity DB, so it must not auto-deploy past an un-applied migration either.
       # Blocks when HEAD is ahead of the global prod-schema tag by a migration; recovery is applying the
diff --git a/.github/workflows/deploy-get.yml b/.github/workflows/deploy-get.yml
index 166ddf26..fb7e0ff1 100644
--- a/.github/workflows/deploy-get.yml
+++ b/.github/workflows/deploy-get.yml
@@ -44,7 +44,7 @@ jobs:
       CLOUDFLARE_API_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CLOUDFLARE_API_TOKEN || '' }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Deploy production (get.webhook.co)
         if: github.event_name == 'push'
diff --git a/.github/workflows/deploy-play.yml b/.github/workflows/deploy-play.yml
index ee847700..6516a3de 100644
--- a/.github/workflows/deploy-play.yml
+++ b/.github/workflows/deploy-play.yml
@@ -35,7 +35,7 @@ jobs:
     # Same-repo only: fork PRs don't receive secrets.
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Dry-run needs no credentials — it validates config locally.
       - name: Validate deploy (dry-run)
diff --git a/.github/workflows/deploy-telemetry.yml b/.github/workflows/deploy-telemetry.yml
index 0cf0823d..090a2c43 100644
--- a/.github/workflows/deploy-telemetry.yml
+++ b/.github/workflows/deploy-telemetry.yml
@@ -41,7 +41,7 @@ jobs:
       CLOUDFLARE_API_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CLOUDFLARE_API_TOKEN || '' }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Deploy production (telemetry.wbhk.my)
         if: github.event_name == 'push'
diff --git a/.github/workflows/deploy-web.yml b/.github/workflows/deploy-web.yml
index d819e303..0806509d 100644
--- a/.github/workflows/deploy-web.yml
+++ b/.github/workflows/deploy-web.yml
@@ -92,7 +92,7 @@ jobs:
       AUTH_DEVICE_KV_ID: ${{ vars.AUTH_DEVICE_KV_ID }}
       AUTH_RATELIMIT_KV_ID: ${{ vars.AUTH_RATELIMIT_KV_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # apps/web reads the tenant DB, so it must not auto-deploy past an un-applied migration either. Blocks
       # when HEAD is ahead of the global prod-schema tag by a migration; recovery is applying the migration
diff --git a/.github/workflows/deploy-www.yml b/.github/workflows/deploy-www.yml
index 9535625a..211eeed7 100644
--- a/.github/workflows/deploy-www.yml
+++ b/.github/workflows/deploy-www.yml
@@ -49,7 +49,7 @@ jobs:
       CLOUDFLARE_API_TOKEN: ${{ github.event_name != 'pull_request' && secrets.CLOUDFLARE_API_TOKEN || '' }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Build static export
         run: pnpm --filter @webhook-co/www build
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 48d7e592..be25115a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -98,7 +98,7 @@ jobs:
       AUTH_DEVICE_KV_ID: ${{ vars.AUTH_DEVICE_KV_ID }}
       AUTH_RATELIMIT_KV_ID: ${{ vars.AUTH_RATELIMIT_KV_ID }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       # Blocks the auto-deploy when a migration was added since prod's schema was last brought current — i.e.
       # HEAD is ahead of the global `prod-schema` tag by a migration. NOT just this push's diff, so a later
diff --git a/.github/workflows/homebrew-bump.yml b/.github/workflows/homebrew-bump.yml
index f02d5933..1ec63a3b 100644
--- a/.github/workflows/homebrew-bump.yml
+++ b/.github/workflows/homebrew-bump.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
       - name: Bump the Homebrew formula
         env:
diff --git a/.github/workflows/nightly-rls.yml b/.github/workflows/nightly-rls.yml
index 05bc3331..d963bfe5 100644
--- a/.github/workflows/nightly-rls.yml
+++ b/.github/workflows/nightly-rls.yml
@@ -80,7 +80,7 @@ jobs:
             exit 1
           fi
           echo "enabled=true" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.guard.outputs.enabled == 'true'
       - uses: ./.github/actions/setup
         if: steps.guard.outputs.enabled == 'true'
diff --git a/.github/workflows/release-cli.yml b/.github/workflows/release-cli.yml
index d404bd00..e6d1bd88 100644
--- a/.github/workflows/release-cli.yml
+++ b/.github/workflows/release-cli.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
 
       # Version-pinned (not SHA-pinned) bun installer — same rationale as ci.yml's completion-smoke job.
diff --git a/.github/workflows/release-sdk-python.yml b/.github/workflows/release-sdk-python.yml
index 22ed3958..1597b6b1 100644
--- a/.github/workflows/release-sdk-python.yml
+++ b/.github/workflows/release-sdk-python.yml
@@ -30,7 +30,7 @@ jobs:
       run:
         working-directory: sdks/python
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
diff --git a/.github/workflows/release-sdk-ts.yml b/.github/workflows/release-sdk-ts.yml
index 0bb50a70..55ead2ee 100644
--- a/.github/workflows/release-sdk-ts.yml
+++ b/.github/workflows/release-sdk-ts.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/setup
 
       # User-controlled values (the dispatch input) flow through env, never `${{ }}`-interpolated into the
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 82df67dc..4ef477f0 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0