diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3fd1145..f7df489 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cf79dc6..6f76730 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7a158d5..e209416 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index 6f3b4c3..6cc9d31 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 20
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 2c07a4d..a9180db 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e5c4525..2251a1d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,7 +19,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 661d167..6f2639a 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: crate-ci/typos@v1.47.2
         continue-on-error: true  # warn-only — surface findings without blocking CI