diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 9994c65..f1c360f 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -15,14 +15,14 @@ jobs:
   dependency-review:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - parallel:
           - name: Check provenance downgrades
-            uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
+            uses: danielroe/provenance-action@fcc45fd5a5b818c477432b32c838dcd0c79cd2dd # v0.2.0
             with:
               fail-on-provenance-change: ${{ inputs.fail-on-provenance-change }}
 
diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml
index 21b8dc8..569d14b 100644
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.merge_commit_sha }}
@@ -77,7 +77,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/triage-comment.yml b/.github/workflows/triage-comment.yml
index 05bb504..ef611c1 100644
--- a/.github/workflows/triage-comment.yml
+++ b/.github/workflows/triage-comment.yml
@@ -47,7 +47,7 @@ jobs:
           echo "Comment from collaborator/member/owner - no automated analysis performed." >> $GITHUB_STEP_SUMMARY
 
       - parallel:
-          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+          - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             if: steps.check-auth.outputs.is_collaborator != 'true'
             with:
               repository: nuxt/.github
diff --git a/.github/workflows/triage-edited.yml b/.github/workflows/triage-edited.yml
index 8d8e25f..d323f08 100644
--- a/.github/workflows/triage-edited.yml
+++ b/.github/workflows/triage-edited.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - parallel:
-          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+          - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             with:
               repository: nuxt/.github
               ref: ${{ inputs.scripts-ref }}
diff --git a/.github/workflows/triage-opened.yml b/.github/workflows/triage-opened.yml
index 333cf52..9cd4184 100644
--- a/.github/workflows/triage-opened.yml
+++ b/.github/workflows/triage-opened.yml
@@ -68,7 +68,7 @@ jobs:
 
     steps:
       - parallel:
-          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+          - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             with:
               repository: nuxt/.github
               ref: ${{ inputs.scripts-ref }}
diff --git a/package.json b/package.json
index 2d0ce62..13df7fd 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "private": true,
   "type": "module",
   "license": "MIT",
-  "packageManager": "pnpm@11.15.1",
+  "packageManager": "pnpm@11.17.0",
   "devDependencies": {
     "@types/node": "^24.13.3"
   }