diff --git a/.github/workflows/sovereign-ci.yml b/.github/workflows/sovereign-ci.yml
index e05628c..ef471d6 100644
--- a/.github/workflows/sovereign-ci.yml
+++ b/.github/workflows/sovereign-ci.yml
@@ -187,7 +187,7 @@ jobs:
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -410,7 +410,7 @@ jobs:
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -617,7 +617,7 @@ jobs:
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -885,7 +885,7 @@ jobs:
           # uid:gid because the runner user has no entry in the image's passwd.
           chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true
           echo "pre-checkout ownership restored under $WORK_ROOT"
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -999,7 +999,7 @@ jobs:
             2>/dev/null || echo "::warning::sccache stats unavailable"
       - name: Upload benchmark results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: bench-${{ inputs.repo }}
           path: bench-results.txt
@@ -1088,7 +1088,7 @@ jobs:
           else
             echo "pre-checkout ownership restored under $WORK_ROOT"
           fi
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install extra packages
@@ -1243,7 +1243,7 @@ jobs:
       attestations: write
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Generate SLSA provenance