diff --git a/.github/workflows/agent-team-apply-verify.yml b/.github/workflows/agent-team-apply-verify.yml
index 9caaea0..5578511 100644
--- a/.github/workflows/agent-team-apply-verify.yml
+++ b/.github/workflows/agent-team-apply-verify.yml
@@ -624,7 +624,7 @@ jobs:
             files.pythonhosted.org:443
 
       - name: Checkout base repo (clean ref; patch applied on top after)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Checkout carries NO token into the working tree usable for writes —
           # this job's permissions are contents:read. persist-credentials:false