diff --git a/.github/workflows/alternative-os-build-main.yml b/.github/workflows/alternative-os-build-main.yml
index 2b23113a613eb..65513789ba292 100644
--- a/.github/workflows/alternative-os-build-main.yml
+++ b/.github/workflows/alternative-os-build-main.yml
@@ -34,7 +34,7 @@ jobs:
         os: [windows-latest, macos-latest, windows-2025]
       fail-fast: false
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up JDK ${{ matrix.os }}
diff --git a/.github/workflows/camel-launcher-native-exe.yml b/.github/workflows/camel-launcher-native-exe.yml
index f9b56e57dc508..ea663f67bce4c 100644
--- a/.github/workflows/camel-launcher-native-exe.yml
+++ b/.github/workflows/camel-launcher-native-exe.yml
@@ -53,7 +53,7 @@ jobs:
       camel-exe: ${{ steps.changes.outputs.camel-exe }}
       camel-launcher: ${{ steps.changes.outputs.camel-launcher }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -93,7 +93,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.camel-exe == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up JDK 25
@@ -122,7 +122,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.camel-exe == 'true'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up JDK 25
@@ -147,7 +147,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.camel-launcher == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up JDK 25
diff --git a/.github/workflows/check-container-versions.yml b/.github/workflows/check-container-versions.yml
index d15e049efce91..9327a922bff8b 100644
--- a/.github/workflows/check-container-versions.yml
+++ b/.github/workflows/check-container-versions.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/depsreview.yaml b/.github/workflows/depsreview.yaml
index f275495d9b791..598ff29fa09cc 100644
--- a/.github/workflows/depsreview.yaml
+++ b/.github/workflows/depsreview.yaml
@@ -31,6 +31,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/generate-sbom-main.yml b/.github/workflows/generate-sbom-main.yml
index 47b23ca3197f5..3d8f6c25faaa6 100644
--- a/.github/workflows/generate-sbom-main.yml
+++ b/.github/workflows/generate-sbom-main.yml
@@ -36,7 +36,7 @@ jobs:
       matrix:
         java: [ '21' ]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - id: install-mvnd
diff --git a/.github/workflows/main-build.yml b/.github/workflows/main-build.yml
index 88748cafd87ff..6fd4bdabd2e0c 100644
--- a/.github/workflows/main-build.yml
+++ b/.github/workflows/main-build.yml
@@ -38,7 +38,7 @@ jobs:
         java: ['25']
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - id: install-packages
diff --git a/.github/workflows/pr-build-main.yml b/.github/workflows/pr-build-main.yml
index 50daccb45d749..93f99b0b9c04c 100644
--- a/.github/workflows/pr-build-main.yml
+++ b/.github/workflows/pr-build-main.yml
@@ -80,7 +80,7 @@ jobs:
             maven_extra_args: '-Denforcer.phase=none'
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ inputs.pr_ref || '' }}
diff --git a/.github/workflows/pr-doc-validation.yml b/.github/workflows/pr-doc-validation.yml
index 538066ea12242..a08af1d940ea0 100644
--- a/.github/workflows/pr-doc-validation.yml
+++ b/.github/workflows/pr-doc-validation.yml
@@ -37,13 +37,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout camel repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
           path: camel
       - name: Checkout camel-website repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: apache/camel-website
           path: camel-website
diff --git a/.github/workflows/pr-id.yml b/.github/workflows/pr-id.yml
index e0299dda1fe86..847707c44592f 100644
--- a/.github/workflows/pr-id.yml
+++ b/.github/workflows/pr-id.yml
@@ -33,7 +33,7 @@ jobs:
       github.repository == 'apache/camel'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
diff --git a/.github/workflows/pr-manual-component-test.yml b/.github/workflows/pr-manual-component-test.yml
index d7a7a1c96e8d4..6047bfc468b2a 100644
--- a/.github/workflows/pr-manual-component-test.yml
+++ b/.github/workflows/pr-manual-component-test.yml
@@ -32,7 +32,7 @@ jobs:
       actions: write # to dispatch workflows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: components
diff --git a/.github/workflows/pr-update-branch.yml b/.github/workflows/pr-update-branch.yml
index 015c2fa534ef9..225dfa6b4c00b 100644
--- a/.github/workflows/pr-update-branch.yml
+++ b/.github/workflows/pr-update-branch.yml
@@ -61,7 +61,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.pr.outputs.head_ref }}
           fetch-depth: 0
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 2738cf4d6d397..5bde2f86e586c 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Set up JDK 25
diff --git a/.github/workflows/sonar-build.yml b/.github/workflows/sonar-build.yml
index 5af89733b06fd..6be0523853ecf 100644
--- a/.github/workflows/sonar-build.yml
+++ b/.github/workflows/sonar-build.yml
@@ -42,7 +42,7 @@ jobs:
     name: Build for Sonar Analysis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Fetch base branch for Scalpel change detection
diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
index 89948b8ea0b26..d99a8333bd82a 100644
--- a/.github/workflows/sonar-scan.yml
+++ b/.github/workflows/sonar-scan.yml
@@ -81,7 +81,7 @@ jobs:
           result-encoding: string
 
       - name: Checkout PR source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.event.workflow_run.head_repository.full_name }}
           ref: ${{ github.event.workflow_run.head_sha }}