diff --git a/.github/workflows/action-test.yml b/.github/workflows/action-test.yml
index 03201a9..28a8009 100644
--- a/.github/workflows/action-test.yml
+++ b/.github/workflows/action-test.yml
@@ -18,7 +18,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, macos-14]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Create test assets
         shell: bash
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1205557..56de466 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, macos-14]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install system dependencies (macOS)
         if: runner.os == 'macOS'
@@ -73,7 +73,7 @@ jobs:
     name: cargo install (--locked path + drift check)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install system dependencies
         run: |
@@ -127,7 +127,7 @@ jobs:
     name: Clippy + rustfmt
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install system dependencies
         run: |
@@ -171,7 +171,7 @@ jobs:
     name: MSRV (1.95)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install system dependencies
         run: |
@@ -210,6 +210,6 @@ jobs:
     name: Supply chain (cargo-deny)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: EmbarkStudios/cargo-deny-action@v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ea3b2c8..793b1e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Create release if absent
         env:
           GH_TOKEN: ${{ github.token }}
@@ -45,7 +45,7 @@ jobs:
           - os: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install system dependencies (macOS)
         if: runner.os == 'macOS'
@@ -98,7 +98,7 @@ jobs:
     # noise, not a signal.
     if: github.repository == 'MikeDre/squish'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Check for the tap token
         env:
@@ -115,7 +115,7 @@ jobs:
       # A separate checkout, not the default token: github.token is scoped to this
       # repository and cannot push to the tap.
       - name: Check out the tap
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: MikeDre/homebrew-tap
           token: ${{ secrets.HOMEBREW_TAP_TOKEN }}