diff --git a/.github/workflows/backport-prs.yml b/.github/workflows/backport-prs.yml
index 8d4bd3911e..9abbddca23 100644
--- a/.github/workflows/backport-prs.yml
+++ b/.github/workflows/backport-prs.yml
@@ -40,7 +40,7 @@ jobs:
           git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
 
       - name: Checkout PR HEAD
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 100
diff --git a/.github/workflows/benchmark-pr.yml b/.github/workflows/benchmark-pr.yml
index 51b79827a4..3e0fe23974 100644
--- a/.github/workflows/benchmark-pr.yml
+++ b/.github/workflows/benchmark-pr.yml
@@ -26,7 +26,7 @@ jobs:
             with:
               python-version: "3.12"
           - name: Checkout repo
-            uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+            uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             with:
               fetch-depth: 0  # Fetch full history
               persist-credentials: false
diff --git a/.github/workflows/cffcheck.yml b/.github/workflows/cffcheck.yml
index 211f5d86c2..4a994a6a7d 100644
--- a/.github/workflows/cffcheck.yml
+++ b/.github/workflows/cffcheck.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml
index 712f20a00b..853b13b61e 100644
--- a/.github/workflows/code-analysis.yml
+++ b/.github/workflows/code-analysis.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/docs-conda.yml b/.github/workflows/docs-conda.yml
index 1c0ff4ee94..5b83b66097 100644
--- a/.github/workflows/docs-conda.yml
+++ b/.github/workflows/docs-conda.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 150
         fetch-tags: true
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 8691baf889..57662c36c4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 150
         persist-credentials: false
@@ -111,7 +111,7 @@ jobs:
 
     steps:
     - name: Checkout docs
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: "gh-pages"
 
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index d7a0b966ff..767b08e7c3 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 18a8f3eeaf..2602813bbd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/tests-conda.yml b/.github/workflows/tests-conda.yml
index 8a7bf537f2..d0373777af 100644
--- a/.github/workflows/tests-conda.yml
+++ b/.github/workflows/tests-conda.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 150
         fetch-tags: true
@@ -71,7 +71,7 @@ jobs:
     timeout-minutes: 2
     steps:
       - name: Checkout source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/tests-pypi.yml b/.github/workflows/tests-pypi.yml
index a55c633de3..2ab5ea8d12 100644
--- a/.github/workflows/tests-pypi.yml
+++ b/.github/workflows/tests-pypi.yml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 150
         fetch-tags: true
@@ -97,7 +97,7 @@ jobs:
     timeout-minutes: 2
     steps:
       - name: Checkout source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/unstable-builds.yml b/.github/workflows/unstable-builds.yml
index 1eb28e408d..06473d6825 100644
--- a/.github/workflows/unstable-builds.yml
+++ b/.github/workflows/unstable-builds.yml
@@ -19,7 +19,7 @@ jobs:
       result: ${{ steps.tests.outcome }}
     steps:
     - name: Checkout source
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 150
         fetch-tags: true
@@ -63,7 +63,7 @@ jobs:
       result: ${{ steps.build.outcome }}
     steps:
     - name: Checkout source
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 150
         fetch-tags: true
diff --git a/.github/workflows/verify-pinned-workflows.yml b/.github/workflows/verify-pinned-workflows.yml
index 3efae8f100..11b3255de9 100644
--- a/.github/workflows/verify-pinned-workflows.yml
+++ b/.github/workflows/verify-pinned-workflows.yml
@@ -11,5 +11,5 @@ jobs:
     name: Verify Pinned Actions
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: unidata/pinned-actions-verifier@a7df1b8ac192ab2903c6b04b64827da1925aac69 # v1.0.1