diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 554c1b7..de237d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/plugin-release.yml b/.github/workflows/plugin-release.yml
index 6fddfd8..8217e2f 100644
--- a/.github/workflows/plugin-release.yml
+++ b/.github/workflows/plugin-release.yml
@@ -24,13 +24,13 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
     steps:
       - name: Code du plugin
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: plugin
           persist-credentials: false
 
       - name: Outils de publication
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wearewp/release-tools
           ref: ${{ inputs.tools-ref }}
@@ -39,7 +39,7 @@ jobs:
 
       # Un relèvement de la version minimale sur main s'applique même aux appels épinglés sur un ancien tag.
       - name: Version minimale de wawp-updater exigée sur main
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wearewp/release-tools
           ref: main
@@ -106,7 +106,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Outils de publication
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wearewp/release-tools
           ref: ${{ inputs.tools-ref }}
diff --git a/.github/workflows/theme-release.yml b/.github/workflows/theme-release.yml
index 0b57fb5..8998598 100644
--- a/.github/workflows/theme-release.yml
+++ b/.github/workflows/theme-release.yml
@@ -24,13 +24,13 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
     steps:
       - name: Code du thème
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: theme
           persist-credentials: false
 
       - name: Outils de publication
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wearewp/release-tools
           ref: ${{ inputs.tools-ref }}
@@ -39,7 +39,7 @@ jobs:
 
       # Un relèvement de la version minimale sur main s'applique même aux appels épinglés sur un ancien tag.
       - name: Version minimale de wawp-theme-updater exigée sur main
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wearewp/release-tools
           ref: main
@@ -106,7 +106,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Outils de publication
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: wearewp/release-tools
           ref: ${{ inputs.tools-ref }}
diff --git a/tests/Unit/WorkflowPolicyTest.php b/tests/Unit/WorkflowPolicyTest.php
index 737ea7a..5dc7942 100644
--- a/tests/Unit/WorkflowPolicyTest.php
+++ b/tests/Unit/WorkflowPolicyTest.php
@@ -88,7 +88,7 @@ public function testBuildChecksThePackageAndTakesTheHighestMinimumUpdaterVersion
         $steps = self::steps($build);
 
         $main = $steps['Version minimale de wawp-updater exigée sur main'] ?? '';
-        foreach (['uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683', 'repository: wearewp/release-tools', 'ref: main', 'path: tools-main', 'sparse-checkout: config', 'persist-credentials: false'] as $needle) {
+        foreach (['uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1', 'repository: wearewp/release-tools', 'ref: main', 'path: tools-main', 'sparse-checkout: config', 'persist-credentials: false'] as $needle) {
             self::assertStringContainsString($needle, $main, $needle);
         }
         $checks = $steps['Contrôles avant publication'] ?? '';