diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92225d58..c98fd297 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -53,7 +53,7 @@ jobs:
     timeout-minutes: 10
     # Hard-fail: tsc --noEmit must be clean.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -126,7 +126,7 @@ jobs:
     # job runs the smoke test that verifies the round-trip on a real
     # cmd.exe.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -153,7 +153,7 @@ jobs:
     # shims should be found through PATH, spawned without shell wrapping, and
     # receive multi-line prompts over stdin unchanged.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b736b9db..3271f1d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -69,7 +69,7 @@ jobs:
       previous_tag: ${{ steps.metadata.outputs.previous_tag }}
       prerelease: ${{ steps.metadata.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history and tags make the previous-tag choice explicit and
           # stable instead of relying on GitHub's implicit previous release.
@@ -103,7 +103,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Keep full history in release jobs so packaging and diagnostics
           # have complete tag metadata available.
@@ -431,7 +431,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -581,7 +581,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0