diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fbb5b68b..70926f23 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_TAG }}
           lfs: true
diff --git a/.github/workflows/cargo-machete.yml b/.github/workflows/cargo-machete.yml
index 770b8804..8e63b739 100644
--- a/.github/workflows/cargo-machete.yml
+++ b/.github/workflows/cargo-machete.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run cargo-machete
         uses: bnjbvr/cargo-machete@v0.9.2
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 64b36a9e..1a300707 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # pull_request_target defaults to the base ref; explicitly check
           # out the PR head so Claude reviews the actual proposed changes.
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 5c4ce9a9..580e80a9 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/humanize-changelog.yml b/.github/workflows/humanize-changelog.yml
index 4b64395e..0317d862 100644
--- a/.github/workflows/humanize-changelog.yml
+++ b/.github/workflows/humanize-changelog.yml
@@ -55,7 +55,7 @@ jobs:
           echo "head_ref=$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout PR head
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.pr.outputs.head_ref }}
           fetch-depth: 0
diff --git a/.github/workflows/openshell-proto-compat.yml b/.github/workflows/openshell-proto-compat.yml
index c509575d..e6a8f17f 100644
--- a/.github/workflows/openshell-proto-compat.yml
+++ b/.github/workflows/openshell-proto-compat.yml
@@ -33,7 +33,7 @@ jobs:
     name: re-vendor + compat check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Resolve latest OpenShell release tag
         id: resolve
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 71a7aafe..578a22c5 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -26,7 +26,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -71,7 +71,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 4dd48cc4..b57db9f6 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -26,7 +26,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
       - name: Setup Pages
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2988d645..6711c1e3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -31,7 +31,7 @@ jobs:
     name: workspace tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
       # onsails/nix-action installs Determinate Nix + Devenv + FlakeHub Cache
@@ -160,7 +160,7 @@ jobs:
       RIGHT_TEST_SANDBOX_READY_TIMEOUT_SECS: "360"
       RIGHT_TEST_SANDBOX_SSH_TIMEOUT_SECS: "120"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
       # Same Determinate Nix + Devenv + FlakeHub Cache combo as the workspace