diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df15b52..4173cb6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-and-run
         with:
           task: lint
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-and-run
         with:
           task: typecheck
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-and-run
         with:
           task: test
@@ -94,7 +94,7 @@ jobs:
       GH_TEST_PAT_CLASSIC_PRIVATE: ${{ secrets.GH_TEST_PAT_CLASSIC_PRIVATE }}
       GH_TEST_PAT_FINE_GRAINED_PRIVATE: ${{ secrets.GH_TEST_PAT_FINE_GRAINED_PRIVATE }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-and-run
         with:
           task: integration-e2e
@@ -113,7 +113,7 @@ jobs:
       contents: write
       issues: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # semantic-release analyses the full commit history since the last release.
           fetch-depth: 0
@@ -150,7 +150,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Check out the latest main (the release commit semantic-release just
           # pushed), not the trigger commit, so the build resolves the new tag.
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 14a76cb..651e8b7 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -16,7 +16,7 @@ jobs:
         if: github.actor == 'dependabot[bot]' || github.event_name != 'pull_request'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@v7
 
             - name: Find Dependabot PRs
               id: find-prs