diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index b17156d63d..362402e0c9 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -16,14 +16,14 @@ jobs:
     runs-on: ubuntu-latest-8-cores
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       with:
           submodules: true
           lfs: true
 
     - name: set up JDK 21
-      uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
       # gh api repos/actions/setup-java/commits/v5 --jq '.sha'
       with:
         distribution: temurin
diff --git a/.github/workflows/diffuse.yml b/.github/workflows/diffuse.yml
index a86b280a75..dc157db26e 100644
--- a/.github/workflows/diffuse.yml
+++ b/.github/workflows/diffuse.yml
@@ -16,14 +16,14 @@ jobs:
     runs-on: ubuntu-latest-8-cores
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       with:
         submodules: true
         ref: ${{ github.event.pull_request.base.sha }}
 
     - name: set up JDK 21
-      uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
       # gh api repos/actions/setup-java/commits/v5 --jq '.sha'
       with:
         distribution: temurin
@@ -61,7 +61,7 @@ jobs:
       if: steps.cache-base.outputs.cache-hit != 'true'
       run: mv app/build/outputs/apk/playProd/release/*arm64*.apk diffuse-base.apk
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       with:
         submodules: true
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8a005290be..be96e4adfc 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -16,7 +16,7 @@ jobs:
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android/sdk/ndk /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
           sudo docker image prune --all --force
           df -h
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0