diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4185eb9..6449a95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,7 +5,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: jdx/mise-action@v4
       - run: pnpm install --frozen-lockfile
       - run: pnpm run format:check
@@ -25,7 +25,7 @@ jobs:
     # mismatch; paste it into flake.nix and push.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - name: nix flake check
@@ -48,7 +48,7 @@ jobs:
       contents: write # softprops/action-gh-release
       id-token: write # npm Trusted Publishing + provenance
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # bundle.js reads git tags
       - uses: jdx/mise-action@v4
@@ -129,7 +129,7 @@ jobs:
       group: nightly-publish
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: jdx/mise-action@v4
diff --git a/.github/workflows/dependabot-nix-hash-sync.yml b/.github/workflows/dependabot-nix-hash-sync.yml
index 4023424..49ca915 100644
--- a/.github/workflows/dependabot-nix-hash-sync.yml
+++ b/.github/workflows/dependabot-nix-hash-sync.yml
@@ -37,7 +37,7 @@ jobs:
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}