diff --git a/.github/workflows/_codeql.yml b/.github/workflows/_codeql.yml
index 5d2f39b694701..70fb341ed0aad 100644
--- a/.github/workflows/_codeql.yml
+++ b/.github/workflows/_codeql.yml
@@ -44,7 +44,7 @@ jobs:
           /usr/local/lib/android
 
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463  # codeql-bundle-v4.36.1
diff --git a/.github/workflows/_cve_fetch.yml b/.github/workflows/_cve_fetch.yml
index d59f9d2bc8403..282e22f01f8a8 100644
--- a/.github/workflows/_cve_fetch.yml
+++ b/.github/workflows/_cve_fetch.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Set vars
       id: vars
       run: |
diff --git a/.github/workflows/_cve_scan.yml b/.github/workflows/_cve_scan.yml
index 72f24e922ce24..60d737a8e540b 100644
--- a/.github/workflows/_cve_scan.yml
+++ b/.github/workflows/_cve_scan.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Set vars
       id: vars
       run: |
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index 09680b566d54b..ba6181da7de68 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -29,7 +29,7 @@ jobs:
       cpp_changed: ${{ steps.detect.outputs.cpp_changed }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 2
 
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
     # No-op analysis satisfies Scorecard SAST when no C++ changes are present.
     - name: Initialize CodeQL (noop)
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 265ca0ba618e0..7f3909b09840b 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -21,7 +21,7 @@ jobs:
         sudo rm -rf /usr/local/lib/android &
         sudo rm -rf /usr/share/dotnet &
     - name: Checkout code
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Install deps
       shell: bash
       run: |
diff --git a/.github/workflows/envoy-dependency.yml b/.github/workflows/envoy-dependency.yml
index 173b1ec47c2d2..144197135f339 100644
--- a/.github/workflows/envoy-dependency.yml
+++ b/.github/workflows/envoy-dependency.yml
@@ -183,7 +183,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Generate report
       run: |
         ./ci/run_envoy_docker.sh './ci/do_ci.sh deps.report' \
@@ -355,7 +355,7 @@ jobs:
       issues: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Run dependency checker
       run: |
         TODAY_DATE=$(date -u -I"date")
diff --git a/.github/workflows/envoy-security-check.yml b/.github/workflows/envoy-security-check.yml
index 118f96c4dba20..1839f8e0687c4 100644
--- a/.github/workflows/envoy-security-check.yml
+++ b/.github/workflows/envoy-security-check.yml
@@ -101,7 +101,7 @@ jobs:
     # SLACK
     - name: Checkout repository (secure branch)
       if: matrix.action == 'slack'
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         # Explicitly checkout main to avoid malicious code
         ref: main
diff --git a/.github/workflows/mobile-release.yml b/.github/workflows/mobile-release.yml
index a4ab21210153d..abe414a9e7986 100644
--- a/.github/workflows/mobile-release.yml
+++ b/.github/workflows/mobile-release.yml
@@ -109,7 +109,7 @@ jobs:
         include:
         - output: envoy
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
     - name: Add safe directory
diff --git a/.github/workflows/pr_notifier.yml b/.github/workflows/pr_notifier.yml
index d4bb0536ced0f..fb4d1160b5517 100644
--- a/.github/workflows/pr_notifier.yml
+++ b/.github/workflows/pr_notifier.yml
@@ -24,7 +24,7 @@ jobs:
               || !contains(github.actor, '[bot]'))
       }}
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Notify about PRs
       run: |
         ARGS=()
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index be56f972eedf1..45d35f6d320b9 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/toolchain-test.yml b/.github/workflows/toolchain-test.yml
index a520ea2ab769c..06cee8553e230 100644
--- a/.github/workflows/toolchain-test.yml
+++ b/.github/workflows/toolchain-test.yml
@@ -36,7 +36,7 @@ jobs:
     name: "Test: ${{ matrix.name }}"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Run matrix test
       run: |
         cd ci/matrix