diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 5551227..eff7ca6 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -25,7 +25,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-cache
         with:
           cache-name: check
@@ -38,7 +38,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-cache
         with:
           cache-name: test
@@ -50,7 +50,7 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-cache
         with:
           cache-name: clippy
@@ -59,7 +59,7 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: rustup toolchain install nightly-2025-07-08 --component rustfmt
       - run: cargo +nightly-2025-07-08 fmt --check
 
diff --git a/.github/workflows/cross-build.yaml b/.github/workflows/cross-build.yaml
index 5c45d33..dfaeee8 100644
--- a/.github/workflows/cross-build.yaml
+++ b/.github/workflows/cross-build.yaml
@@ -27,7 +27,7 @@ jobs:
           - { arch: aarch64-darwin, runner: macos-latest }
           - { arch: x86_64-darwin, runner: macos-latest }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Configure R2 credentials
         uses: ./.github/actions/setup-r2-credentials
@@ -36,7 +36,7 @@ jobs:
           r2-secret-access-key: ${{ secrets.R2_SECRET_ACCESS_KEY }}
 
       - name: Install nix
-        uses: nixbuild/nix-quick-install-action@v34
+        uses: nixbuild/nix-quick-install-action@v35
         with:
           nix_conf: |
             substituters = ${{ env.NIX_CACHE_URI }} https://cache.nixos.org/
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 68614ef..781ff29 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -17,7 +17,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate tag matches Cargo version
         id: version
         run: |
@@ -40,7 +40,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-cache
         with:
           cache-name: publish-test
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-version, cross-build]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v8