diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 41342f4..afc23fa 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -17,7 +17,7 @@ jobs:
     name: Code Quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
@@ -44,7 +44,7 @@ jobs:
     needs: code-quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
@@ -80,7 +80,7 @@ jobs:
       VPS_PORT: ${{ secrets.VPS_PORT }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Download artifact
         uses: actions/download-artifact@v4
@@ -242,7 +242,7 @@ jobs:
       # before^..after del push; con el fetch-depth:1 por defecto, un push con 2+
       # commits no puede resolver ese rango ("unknown revision") y el job falla con
       # exit 1 sin haber escaneado nada, aparentando (falsamente) un secreto filtrado.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 417b848..4cab90a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
       uses: actions/setup-dotnet@v4