diff --git a/.github/workflows/backmerge.yml b/.github/workflows/backmerge.yml
index 5870bd42..6ed40c61 100644
--- a/.github/workflows/backmerge.yml
+++ b/.github/workflows/backmerge.yml
@@ -21,7 +21,7 @@ jobs:
   open-backmerge-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13ea5718..de67d1a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # Fetch LFS blobs (png/ttf/woff2): the icon generator and the font
           # assets read real bytes, not the LFS pointer text.
@@ -97,7 +97,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # Fetch LFS blobs (png/ttf/woff2): the icon generator and the font
           # assets read real bytes, not the LFS pointer text.
@@ -228,7 +228,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # Nothing this job reads is LFS-tracked today, but fetch the blobs
           # anyway: if a fixture or an asset the CLI touches ever becomes
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1e100002..03e32b42 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # No LFS and no submodules on purpose. CodeQL reads source, not
           # binary assets, and examples/test-repo is a fixture whose contents
@@ -106,7 +106,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           lfs: false
           submodules: false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b63ac1fc..63f7b6e3 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # mike needs full history plus the gh-pages branch it maintains.
           fetch-depth: 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 669afd4c..4b5c3ae6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # check-tag-branch.mjs asks whether the tag is reachable from main or
           # develop, which needs the full history and those branch refs -- a
@@ -143,7 +143,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # The desktop build needs real binary assets (LFS-tracked fonts and
           # icon source PNGs), not LFS pointer files.
@@ -488,7 +488,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v5