diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0720589..fedaf5d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
   gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up pnpm (version from the package.json `packageManager` field)
         uses: pnpm/action-setup@v4
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7422509..fb59e22 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -29,7 +29,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up pnpm (version from the package.json `packageManager` field)
         uses: pnpm/action-setup@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6e07aad..a76ee3d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # The release is install-free — it ships the committed mem bundle and runs only the dep-free check-plugin
       # gate (node:* builtins). So set up node alone and DISABLE setup-node's package-manager cache: with no