diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81086d53..0dbb50b3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
           - {VERSION: "3.14", NOXSESSION: "tests", NOTE: "minimal", SODIUM_INSTALL_MINIMAL: "1"}
     name: "Linux ${{ matrix.PYTHON.VERSION }} ${{ matrix.PYTHON.NOXSESSION }} ${{ matrix.PYTHON.NOTE }}"
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Setup python
         uses: actions/setup-python@v6
         with:
@@ -80,7 +80,7 @@ jobs:
             RUNNER: macos-latest
     name: "${{ matrix.RUNNER }} ${{ matrix.PYTHON.VERSION }} ${{ matrix.python.NOXSESSION }} ${{ matrix.PYTHON.NOTE }}"
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Setup python
         uses: actions/setup-python@v6
         with:
@@ -106,7 +106,7 @@ jobs:
 
     name: "Windows ${{ matrix.WINDOWS.ARCH }} ${{ matrix.PYTHON.VERSION }} ${{ matrix.PYTHON.NOXSESSION }}"
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Setup python
         uses: actions/setup-python@v6
         with:
@@ -137,7 +137,7 @@ jobs:
     if: ${{ always() }}
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         timeout-minutes: 3
         with:
           persist-credentials: false
diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml
index e5e3f0cb..97a14c83 100644
--- a/.github/workflows/wheel-builder.yml
+++ b/.github/workflows/wheel-builder.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     name: sdist
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           # The tag to build or the tag received by the tag event
           ref: ${{ github.event.inputs.version || github.ref }}
@@ -76,7 +76,7 @@ jobs:
           sed -i "s:ID=alpine:ID=NotpineForGHA:" /etc/os-release
         if: startsWith(matrix.MANYLINUX.NAME, 'musllinux') && endsWith(matrix.MANYLINUX.NAME, 'aarch64')
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           # The tag to build or the tag received by the tag event
           ref: ${{ github.event.inputs.version || github.ref }}
@@ -121,7 +121,7 @@ jobs:
             BIN_PATH: '/Library/Frameworks/PythonT.framework/Versions/3.14/bin/python3.14t'
     name: "Python ${{ matrix.PYTHON.VERSION }} ${{ matrix.PYTHON.ABI_VERSION }} on macOS"
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           # The tag to build or the tag received by the tag event
           ref: ${{ github.event.inputs.version || github.ref }}
@@ -182,7 +182,7 @@ jobs:
             PYTHON: {VERSION: '3.14t', SODIUM_MSVC_VERSION: 'v143'}
     name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.ARCH }} ${{ matrix.PYTHON.ABI_VERSION }}"
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           # The tag to build or the tag received by the tag event
           ref: ${{ github.event.inputs.version || github.ref }}