diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fb36784..d9b3ac0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
       # shallow clone answers it WRONGLY rather than refusing: `git merge-base
       # --is-ancestor` exits non-zero for a commit outside the graft window,
       # which is byte-identical to "not an ancestor".
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a96182..852e901 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0