diff --git a/.github/workflows/container.yaml b/.github/workflows/container.yaml
index 911b6038df..b066ab953d 100644
--- a/.github/workflows/container.yaml
+++ b/.github/workflows/container.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
diff --git a/.github/workflows/gitlab-helper.yml b/.github/workflows/gitlab-helper.yml
index 4dbba52e3f..2e6eb6f9f7 100644
--- a/.github/workflows/gitlab-helper.yml
+++ b/.github/workflows/gitlab-helper.yml
@@ -29,7 +29,7 @@ jobs:
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
index da4ca3b060..134be9dee8 100644
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -23,7 +23,7 @@ jobs:
       # (go.opencensus.io/trace)
       GOPROXY: "https://proxy.golang.org,direct"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install Golang
         run: dnf install -y golang
       - name: Vendor Go dependencies
diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml
index 33425187f2..5765116c29 100644
--- a/.github/workflows/pytest.yaml
+++ b/.github/workflows/pytest.yaml
@@ -20,7 +20,7 @@ jobs:
       - name: Install project dependencies
         run: sudo apt install -y libgpgme-dev libbtrfs-dev libvirt-dev
       - name: "Clone Repository"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Python
         uses: actions/setup-python@v6
       - name: Run linters
@@ -30,7 +30,7 @@ jobs:
     name: "Manifest"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/testdeps
       - name: Install integration test env
         run: |
@@ -45,7 +45,7 @@ jobs:
     name: "Build"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/testdeps
       - name: Install integration test env
         run: |
@@ -60,7 +60,7 @@ jobs:
     name: "Build (Cross-Architecture)"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/testdeps
       - name: Install integration test env
         run: |
@@ -78,7 +78,7 @@ jobs:
     name: "Smoke"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/testdeps
       - name: Install integration test env
         run: |
diff --git a/.github/workflows/rhel.yaml b/.github/workflows/rhel.yaml
index 621e374d86..ae16ff84e3 100644
--- a/.github/workflows/rhel.yaml
+++ b/.github/workflows/rhel.yaml
@@ -41,7 +41,7 @@ jobs:
           echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
           echo "Job originally triggered by ${{ github.actor }}"
           exit 1
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Run integration tests via pytest
diff --git a/.github/workflows/test-osbuild-composer-integration.yml b/.github/workflows/test-osbuild-composer-integration.yml
index ea6b8a6c80..dfd215cd87 100644
--- a/.github/workflows/test-osbuild-composer-integration.yml
+++ b/.github/workflows/test-osbuild-composer-integration.yml
@@ -74,7 +74,7 @@ jobs:
         run: dnf -y install krb5-devel gcc git-core go gpgme-devel osbuild-depsolve-dnf btrfs-progs-devel device-mapper-devel jq
 
       - name: Check out osbuild-composer main branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: osbuild-composer
           repository: osbuild/osbuild-composer
@@ -82,7 +82,7 @@ jobs:
           set-safe-directory: true
 
       - name: Check out osbuild/images for the PR
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: images
           ref: ${{ github.event.pull_request.head.sha }}
@@ -188,7 +188,7 @@ jobs:
         run: dnf -y install krb5-devel gcc git-core go gpgme-devel osbuild-depsolve-dnf btrfs-progs-devel device-mapper-devel jq
 
       - name: Check out image-builder-cli main branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: image-builder-cli
           repository: osbuild/image-builder-cli
@@ -196,7 +196,7 @@ jobs:
           set-safe-directory: true
 
       - name: Check out osbuild/images for the PR
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: images
           ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index dddf2cecc2..ce31dffa71 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -39,7 +39,7 @@ jobs:
       GOPROXY: "https://proxy.golang.org|direct"
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -81,7 +81,7 @@ jobs:
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -133,7 +133,7 @@ jobs:
         run: dnf config-manager --set-enabled crb
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -168,7 +168,7 @@ jobs:
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -201,7 +201,7 @@ jobs:
       # (go.opencensus.io/trace)
       GOPROXY: "https://proxy.golang.org|direct"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -226,7 +226,7 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -250,7 +250,7 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -270,7 +270,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           set-safe-directory: true
@@ -303,7 +303,7 @@ jobs:
       options: "--privileged"
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           set-safe-directory: true
 
diff --git a/.github/workflows/trigger-gitlab.yml b/.github/workflows/trigger-gitlab.yml
index a981aba8c8..4d036f1ed9 100644
--- a/.github/workflows/trigger-gitlab.yml
+++ b/.github/workflows/trigger-gitlab.yml
@@ -27,7 +27,7 @@ jobs:
           sudo apt install -y jq
 
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
diff --git a/.github/workflows/validate-checksums.yml b/.github/workflows/validate-checksums.yml
index fd45c47568..ede48e08e2 100644
--- a/.github/workflows/validate-checksums.yml
+++ b/.github/workflows/validate-checksums.yml
@@ -28,7 +28,7 @@ jobs:
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           # we need the history of the branch and main