diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0c359c..08932e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -55,7 +55,7 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -88,7 +88,7 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -133,7 +133,7 @@ jobs:
       run:
         working-directory: moodle-plugin/local/minerva
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: shivammathur/setup-php@v2
         with:
@@ -160,7 +160,7 @@ jobs:
     runs-on: ubuntu-latest
     container: debian:trixie
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install lua + apache + mods
         # mod_lua is bundled into apache2-bin on Debian trixie (no
@@ -202,7 +202,7 @@ jobs:
     name: Ban emdashes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Check for emdashes
         run: |
@@ -250,7 +250,7 @@ jobs:
     # pre-commit is still caught here.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check
         run: python3 scripts/validate-dashboards.py
 
@@ -264,7 +264,7 @@ jobs:
     # pre-commit is still caught here.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Need full history so the baseline SHA is reachable.
           fetch-depth: 0
diff --git a/.github/workflows/daisy-sync.yml b/.github/workflows/daisy-sync.yml
index 55d91aa..3aabf02 100644
--- a/.github/workflows/daisy-sync.yml
+++ b/.github/workflows/daisy-sync.yml
@@ -27,7 +27,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 07530ea..6aba724 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -22,7 +22,7 @@ jobs:
       github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Package Moodle plugin
         run: |
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set image tag in kustomization
         # Rewrites every `newTag:` line in the prod overlay so all five
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b6efd59..fbf736e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -50,7 +50,7 @@ jobs:
             image_suffix: "-scheduler"
             runtime_stage: runtime-svc
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v4
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 08a1036..d712039 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ci]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Get version from tag
         id: version
diff --git a/.github/workflows/sync-moodle-plugin.yml b/.github/workflows/sync-moodle-plugin.yml
index d708696..3b2c899 100644
--- a/.github/workflows/sync-moodle-plugin.yml
+++ b/.github/workflows/sync-moodle-plugin.yml
@@ -31,7 +31,7 @@ jobs:
             ssh_host: gitea.dsv.su.se
             remote: git@gitea.dsv.su.se:edsu8469/moodle-local_minerva.git
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history required so `git subtree split` can rewrite
           # the per-commit history of moodle-plugin/local/minerva
diff --git a/.github/workflows/transcripts.yml b/.github/workflows/transcripts.yml
index 33d651f..3fe6832 100644
--- a/.github/workflows/transcripts.yml
+++ b/.github/workflows/transcripts.yml
@@ -18,7 +18,7 @@ jobs:
   fetch-transcripts:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with: