diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c42af5c..9e47b98 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with:
diff --git a/.github/workflows/gem_push.yml b/.github/workflows/gem_push.yml
index 9e55104..da03426 100644
--- a/.github/workflows/gem_push.yml
+++ b/.github/workflows/gem_push.yml
@@ -23,10 +23,12 @@ jobs:
       BUNDLE_WITHOUT: sig
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: ruby
+          # Sigstore signing fails on Ruby 4.0, whose json 3 rejects options
+          # that protobug 0.1.0 passes to JSON.parse. Use 3.4 until it's fixed.
+          ruby-version: '3.4'
           bundler-cache: true
       - uses: rubygems/configure-rubygems-credentials@v1.0.0
       - name: Update RubyGems
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 72efcff..136e201 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with:
diff --git a/.github/workflows/mutant.yml b/.github/workflows/mutant.yml
index c876624..a5d4c16 100644
--- a/.github/workflows/mutant.yml
+++ b/.github/workflows/mutant.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 06ce6ba..188a196 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
         ruby: [ ruby-3.2, ruby-3.3, ruby-3.4, ruby-4.0 ]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with:
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 54f0fe7..a54e0dc 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ruby/setup-ruby@v1
         with: