diff --git a/.github/workflows/code_quality.yml b/.github/workflows/code_quality.yml
index 7cec011..7d94a47 100644
--- a/.github/workflows/code_quality.yml
+++ b/.github/workflows/code_quality.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -93,7 +93,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Pozor: skript končí kódem 0 i když něco najde, výsledek je jen
       # v logu. Prázdný log (samotná hlavička) znamená čisto.
@@ -120,7 +120,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Verze CLI napevno – formát validace se mezi verzemi mění.
       # Node je v ubuntu-latest předinstalovaný.
@@ -144,7 +144,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Smoke test
         run: |
@@ -161,7 +161,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Zip plugin
         run: zip -r amcr_viewer.zip amcr_viewer -x "*.git*"
diff --git a/.github/workflows/release_plugin.yml b/.github/workflows/release_plugin.yml
index 7181716..32e3d14 100644
--- a/.github/workflows/release_plugin.yml
+++ b/.github/workflows/release_plugin.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       # 1. Stáhne kód z tagu, který běh spustil
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # 2. Vytvoří ZIP (předpokládá, že kód je ve složce 'amcr_viewer')
       - name: Zip Plugin
@@ -34,7 +34,7 @@ jobs:
       # 3. Založí koncept releasu i s přílohou
       #    Tagy s pomlčkou (v2.0.0-alpha.1) se označí jako pre-release.
       - name: Create draft release with asset
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: amcr_viewer.zip
           draft: true