diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51b33e8..5d80d59 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -44,7 +44,7 @@ jobs:
   schema-consistency:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/cowork-auto-pr.yml b/.github/workflows/cowork-auto-pr.yml
index b27f04e..7a86563 100644
--- a/.github/workflows/cowork-auto-pr.yml
+++ b/.github/workflows/cowork-auto-pr.yml
@@ -16,7 +16,7 @@ jobs:
       # without this step every run failed with "not a git repository" and no
       # PR was ever opened (fleet-wide defect: 11/11 seeded copies lacked it).
       - name: Check out the pushed branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index f1b36c8..3a6840c 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -18,7 +18,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Setup Pages
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 133dd4b..0a7615b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,7 +23,7 @@ jobs:
     environment: pypi
 
     steps:
-      - uses: actions/checkout@v4  # v4.2.2 (pinned)
+      - uses: actions/checkout@v7  # v4.2.2 (pinned)
         with:
           persist-credentials: false
 
@@ -62,7 +62,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4  # v4.2.2 (pinned)
+      - uses: actions/checkout@v7  # v4.2.2 (pinned)
         with:
           persist-credentials: false
       - uses: actions/setup-node@v7