diff --git a/.github/workflows/integ.yml b/.github/workflows/integ.yml
index 9ed16af4b..e6a059ff5 100644
--- a/.github/workflows/integ.yml
+++ b/.github/workflows/integ.yml
@@ -42,10 +42,11 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          allow-unsafe-pr-checkout: true
       - name: Fetch tags from origin repo
         id: fetch_tags_from_origin_repo
         run: |-
diff --git a/projenrc/cdk-cli-integ-tests.ts b/projenrc/cdk-cli-integ-tests.ts
index 3a48de7a6..3f670e331 100644
--- a/projenrc/cdk-cli-integ-tests.ts
+++ b/projenrc/cdk-cli-integ-tests.ts
@@ -384,12 +384,16 @@ export class CdkCliIntegTestsWorkflow extends Component {
       steps: [
         {
           name: 'Checkout',
-          uses: 'actions/checkout@v6',
+          uses: 'actions/checkout@v7',
           with: {
             // IMPORTANT! This must be `head.sha` not `head.ref`, otherwise we
             // are vulnerable to a TOCTOU attack.
-            ref: '${{ github.event.pull_request.head.sha }}',
-            repository: '${{ github.event.pull_request.head.repo.full_name }}',
+            'ref': '${{ github.event.pull_request.head.sha }}',
+            'repository': '${{ github.event.pull_request.head.repo.full_name }}',
+            // Need to allow forks, the workflow has been reviewed and getting OIDC credentials is the point
+            // Other credentials are environment protected
+            // @see https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+            'allow-unsafe-pr-checkout': true,
           },
         },
         // We used to fetch tags from the repo using 'checkout', but if it's a fork