diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ec05ad..36b97a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
 
       - name: Set up devtools (pull or build)
         uses: ./.github/actions/setup-devtools
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
 
       - name: Set up devtools (pull or build)
         uses: ./.github/actions/setup-devtools
@@ -72,7 +72,7 @@ jobs:
     needs: unit
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
 
       - name: Set up devtools (pull or build)
         uses: ./.github/actions/setup-devtools
@@ -103,7 +103,7 @@ jobs:
       # fetch-depth: 0 (full history) — this job's checkout is what
       # gitleaks/trufflehog scan (see scripts/security-scan.sh); the default
       # shallow (depth-1) clone would only ever see the single latest commit.
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
         with:
           fetch-depth: 0
 
@@ -124,7 +124,7 @@ jobs:
     timeout-minutes: 30
     if: "!github.event.pull_request.draft"
     steps:
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
 
       - name: Set up devtools (pull or build)
         uses: ./.github/actions/setup-devtools
diff --git a/.github/workflows/devtools-image.yml b/.github/workflows/devtools-image.yml
index d2a0561..2bc9fd1 100644
--- a/.github/workflows/devtools-image.yml
+++ b/.github/workflows/devtools-image.yml
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
 
       # Two forms of the same hash, and both are load-bearing:
       #   `hash`     — 12 chars, the image TAG (readable, collision-free enough).
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cfb7bb5..0218150 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
       # fetch-depth: 0 — qa-security's gitleaks/trufflehog scan the checkout,
       # and the default shallow clone would only ever show them one commit.
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
         with:
           fetch-depth: 0
 
@@ -78,7 +78,7 @@ jobs:
       contents: write   # create the GitHub Release and upload its assets
       packages: write   # push images and the chart to GHCR
     steps:
-      - uses: actions/checkout@v6  # v4.3.1
+      - uses: actions/checkout@v7  # v4.3.1
 
       - name: Set up devtools (pull or build)
         uses: ./.github/actions/setup-devtools