diff --git a/.github/workflows/base-image.yml b/.github/workflows/base-image.yml
index 5cebe3e9..783a08cc 100644
--- a/.github/workflows/base-image.yml
+++ b/.github/workflows/base-image.yml
@@ -50,7 +50,7 @@ jobs:
             platform_key: linux-arm64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
 
@@ -117,7 +117,7 @@ jobs:
             dockerfile: images/Dockerfile.base-image-agents
             repository: ghcr.io/buildkite/cleanroom-base/alpine-agents
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Compute base image tag
         id: meta