diff --git a/.github/workflows/docs-links.yml b/.github/workflows/docs-links.yml
index 3c99ded..dbdc4dc 100644
--- a/.github/workflows/docs-links.yml
+++ b/.github/workflows/docs-links.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run lychee link checker
         uses: lycheeverse/lychee-action@v2
diff --git a/.github/workflows/playground-demo.yml b/.github/workflows/playground-demo.yml
index 971b0dd..95efb56 100644
--- a/.github/workflows/playground-demo.yml
+++ b/.github/workflows/playground-demo.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Build clean plugin ZIP
         run: |
diff --git a/.github/workflows/review-gate.yml b/.github/workflows/review-gate.yml
index 9e66524..84cfbe1 100644
--- a/.github/workflows/review-gate.yml
+++ b/.github/workflows/review-gate.yml
@@ -58,7 +58,7 @@ jobs:
       # Pin to the default branch — see the SECURITY note above. This is the
       # trusted copy of the script regardless of which event triggered the run.
       - name: Check out review-gate script (default branch)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.repository.default_branch }}
           sparse-checkout: .github/scripts/review-gate.js