diff --git a/.github/workflows/bump-and-release.yml b/.github/workflows/bump-and-release.yml
index 3778f94..9761aa7 100644
--- a/.github/workflows/bump-and-release.yml
+++ b/.github/workflows/bump-and-release.yml
@@ -33,7 +33,7 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # PAT so the bump commit can be pushed to protected master.
           # GITHUB_TOKEN (github-actions[bot]) cannot bypass branch rules.
@@ -122,7 +122,7 @@ jobs:
     needs: bump
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.bump.outputs.tag }}
 
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 40e4d04..f5c7c2b 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -19,19 +19,19 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: cargo fmt --all --check
 
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy --all-targets --all-features -- -D warnings
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --all-features
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9acb760..565799a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,13 +21,13 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: cargo fmt --all --check
 
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy --all-targets --all-features -- -D warnings
 
@@ -65,7 +65,7 @@ jobs:
         run: |
           pacman -Syu --noconfirm git curl base-devel openssl pkgconf
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Explicit per-version install: RUSTUP_TOOLCHAIN overrides
       # rust-toolchain.toml, and the distro containers have no preinstalled Rust.
@@ -83,7 +83,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --release
 
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index bf20c01..7049a86 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -21,7 +21,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: Swatinem/rust-cache@v2
 
       - name: Publish