diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml
index 51ad682..43c557c 100644
--- a/.github/workflows/build-publish.yml
+++ b/.github/workflows/build-publish.yml
@@ -49,7 +49,7 @@ jobs:
       APP_NAME: LockIME
       TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history + tags so the release-notes step can list the
           # direct-push commits in <previous-tag>..HEAD.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 555671c..0f38ae0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,7 +48,7 @@ jobs:
     if: needs.gate.outputs.run == 'true'
     runs-on: blacksmith-6vcpu-macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Select Xcode 26
         run: |
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ed5d627..c9a2412 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -31,7 +31,7 @@ jobs:
       version: ${{ steps.compute.outputs.version }}
       tag: ${{ steps.compute.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 467d710..717e5fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,7 +47,7 @@ jobs:
       channel: ${{ steps.compute.outputs.channel }}
       prerelease: ${{ steps.compute.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true