diff --git a/.github/workflows/check-release-pr.yml b/.github/workflows/check-release-pr.yml
index 2fd81ad..848ae77 100644
--- a/.github/workflows/check-release-pr.yml
+++ b/.github/workflows/check-release-pr.yml
@@ -11,7 +11,7 @@ jobs:
     if: startsWith(github.head_ref, 'release-please--')
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Derive GHCR package names from bundles.lock
         id: pkgs
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 732c355..63cb6fd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -63,7 +63,7 @@ jobs:
     name: Unit tests
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -90,7 +90,7 @@ jobs:
           && (matrix.os == 'jammy' && 'ubuntu-22.04-arm' || 'ubuntu-24.04-arm')
           || (matrix.os == 'jammy' && 'ubuntu-22.04' || 'ubuntu-24.04') }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -154,7 +154,7 @@ jobs:
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -237,7 +237,7 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # lockfile update push needs full history
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 990843f..9079735 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -17,7 +17,7 @@ jobs:
           config-file: .github/release-please-config.json
           manifest-file: .github/.release-please-manifest.json
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ steps.release.outputs.release_created }}
         with:
           fetch-depth: 0
diff --git a/.github/workflows/watch-php-releases.yml b/.github/workflows/watch-php-releases.yml
index f135ec1..1b90d68 100644
--- a/.github/workflows/watch-php-releases.yml
+++ b/.github/workflows/watch-php-releases.yml
@@ -12,7 +12,7 @@ jobs:
   check:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Poll php.net
         id: poll
         run: |
diff --git a/.github/workflows/watch-runner-images.yml b/.github/workflows/watch-runner-images.yml
index 049725c..86a4b33 100644
--- a/.github/workflows/watch-runner-images.yml
+++ b/.github/workflows/watch-runner-images.yml
@@ -12,7 +12,7 @@ jobs:
   check:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check runner images
         id: check
         env: