diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
index 5d9bd1511..2187301ff 100644
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -27,7 +27,7 @@ jobs:
       versions: ${{ steps.get_versions.outputs.versions }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Get supported PostgreSQL versions
         id: get_versions
diff --git a/.github/workflows/bake_targets.yml b/.github/workflows/bake_targets.yml
index e1fcd1d34..d77bc0ed1 100644
--- a/.github/workflows/bake_targets.yml
+++ b/.github/workflows/bake_targets.yml
@@ -50,12 +50,12 @@ jobs:
       images: ${{ steps.images.outputs.images }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # bake-action/subaction/matrix doesn't support remote bake files.
       # As a workaround, we clone the repository to allow passing the path to a local file.
       - name: Checkout additional remote source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         if: ${{ inputs.bake_remote_source != '' }}
         with:
           repository: ${{ inputs.bake_remote_source }}
@@ -149,7 +149,7 @@ jobs:
         image: ${{fromJson(needs.testbuild.outputs.images)}}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Security checks
         # NOTE: Do not modify this to point to the local action "./.github/actions/security-scans",
diff --git a/.github/workflows/bake_update.yml b/.github/workflows/bake_update.yml
index ae9b48712..386bd1d45 100644
--- a/.github/workflows/bake_update.yml
+++ b/.github/workflows/bake_update.yml
@@ -16,7 +16,7 @@ jobs:
     name: Run update script
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.REPO_GHA_PAT }}
 
diff --git a/.github/workflows/catalogs.yml b/.github/workflows/catalogs.yml
index c94e5fc25..be2c3c8cc 100644
--- a/.github/workflows/catalogs.yml
+++ b/.github/workflows/catalogs.yml
@@ -20,13 +20,13 @@ jobs:
     steps:
       # TODO: remove this step once system images are EOL
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: postgres-containers
           token: ${{ secrets.REPO_GHA_PAT }}
 
       - name: Checkout artifacts
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: artifacts
           repository: cloudnative-pg/artifacts