diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8b274f4..cb455ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ jobs:
   go:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with: {go-version: "1.25.x", cache: true}
       - run: test -z "$(gofmt -l cmd internal sdk/go gen tests/integration)"
@@ -22,7 +22,7 @@ jobs:
   python:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with: {python-version: "3.13", cache: pip}
       - run: pip install -e 'sdk/python[dev]'
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     defaults: {run: {working-directory: web}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with: {node-version: 22, cache: npm, cache-dependency-path: web/package-lock.json}
       - run: npm ci
@@ -47,7 +47,7 @@ jobs:
   protobuf:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with: {fetch-depth: 0}
       - uses: bufbuild/buf-setup-action@v1
         with: {github_token: "${{ github.token }}"}
@@ -56,7 +56,7 @@ jobs:
   deployment:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: hashicorp/setup-terraform@v3
         with: {terraform_version: 1.10.5}
       - uses: azure/setup-helm@v4
@@ -75,7 +75,7 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with: {go-version: "1.25.x", cache: true}
       - run: go test -tags=integration -count=1 -timeout=15m ./tests/integration
@@ -92,7 +92,7 @@ jobs:
           - {service: worker-python, dockerfile: sdk/python/Dockerfile, build-args: ""}
           - {service: web, dockerfile: web/Dockerfile, build-args: "WEB_DEVELOPMENT_MODE=false"}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: docker/setup-buildx-action@v3
       - uses: docker/build-push-action@v6
         with:
@@ -107,7 +107,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [deployment]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: azure/setup-helm@v4
         with: {version: v3.17.3}
       - name: Install kind
@@ -120,7 +120,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [containers]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: docker compose up -d --build postgres redpanda migrate control-plane scheduler worker-python web
       - run: bash tests/e2e/smoke.sh
       - uses: actions/setup-node@v4
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 048e3e0..9da7cf8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy: {matrix: {language: [go, javascript-typescript, python]}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v3
         with: {languages: "${{ matrix.language }}"}
       - uses: github/codeql-action/autobuild@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 99b4d24..786e6a4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
             dockerfile: web/Dockerfile
             build-args: WEB_DEVELOPMENT_MODE=false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4