diff --git a/.github/workflows/buildifier.yaml b/.github/workflows/buildifier.yaml
index 6b43db0..4d94e26 100644
--- a/.github/workflows/buildifier.yaml
+++ b/.github/workflows/buildifier.yaml
@@ -16,6 +16,6 @@ jobs:
     name: Buildifier Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: buildifier
         run: bazel run --enable_bzlmod //.github/workflows:buildifier.check
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 296166b..8bcf392 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -41,7 +41,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pre-commit/action@v3.0.1
   # For branch protection settings, this job provides a "stable" name that can be used to gate PR merges
   # on "all matrix jobs were successful".
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 5a15f77..fa60866 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -21,7 +21,7 @@ jobs:
       new-tag-version-type: ${{steps.ccv.outputs.new-tag-version-type}}
       recently-tagged: ${{steps.recent-tag.outputs.recently-tagged}}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Need enough history to find the prior release tag
           fetch-depth: 0