diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 33eaadb..44a89e7 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # Install both the matrix JDK (test execution) and JDK 17 (compile +
       # Gradle daemon runtime). Order matters: setup-java sets JAVA_HOME
@@ -89,7 +89,7 @@ jobs:
         java: ['17', '21', '25']
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up JDKs (test=${{ matrix.java }}, compile/daemon=17)
         uses: actions/setup-java@v4
diff --git a/.github/workflows/pr-integration-on-demand.yml b/.github/workflows/pr-integration-on-demand.yml
index 9fc5a51..ef1231d 100644
--- a/.github/workflows/pr-integration-on-demand.yml
+++ b/.github/workflows/pr-integration-on-demand.yml
@@ -143,7 +143,7 @@ jobs:
       # Check out exactly the PR's HEAD commit so we test the proposed
       # change, not the merge ref.
       - name: Checkout PR head
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.guard.outputs.head_sha }}
 
diff --git a/.github/workflows/pr-matrix-on-demand.yml b/.github/workflows/pr-matrix-on-demand.yml
index 5dda271..15877d5 100644
--- a/.github/workflows/pr-matrix-on-demand.yml
+++ b/.github/workflows/pr-matrix-on-demand.yml
@@ -106,7 +106,7 @@ jobs:
     steps:
       # Check out exactly the PR's HEAD commit, not the merge ref.
       - name: Checkout PR head
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.guard.outputs.head_sha }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 145a15c..1e97753 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -75,7 +75,7 @@ jobs:
       ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_KEY_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Build from the explicit commit when chained; else the launch commit.
           ref: ${{ inputs.ref || github.sha }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 4411957..5abf441 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # PRs only run on JDK 17 (the minimum target). Forward-compat
       # regressions on JDK 21/25 are caught post-merge by main.yml.
diff --git a/.github/workflows/tag-and-release.yml b/.github/workflows/tag-and-release.yml
index 33a10ad..69bcf10 100644
--- a/.github/workflows/tag-and-release.yml
+++ b/.github/workflows/tag-and-release.yml
@@ -71,7 +71,7 @@ jobs:
           }
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
 
@@ -112,7 +112,7 @@ jobs:
       sha: ${{ steps.resolve.outputs.sha }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}