diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1dfcd0f4..7d61d195 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,7 +56,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -116,7 +116,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -175,7 +175,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -225,7 +225,7 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
@@ -290,7 +290,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           submodules: recursive
diff --git a/dist-workspace.toml b/dist-workspace.toml
index 21bd76a8..17d0777f 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -30,3 +30,8 @@ container = "quay.io/pypa/manylinux_2_28_x86_64"
 [dist.github-custom-runners.aarch64-unknown-linux-gnu]
 runner = "ubuntu-22.04-arm"
 container = "quay.io/pypa/manylinux_2_28_aarch64"
+
+# Unblocks dependabot PRs that update Github Action versions,
+# since `release.yml` is not allowed to be modified by hand.
+[dist.github-action-commits]
+"actions/checkout" = "v7.0.1"