diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4c9d0d..e9ee0c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,13 +10,13 @@ jobs:
     name: Validate submission.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: python3 scripts/validate_submission.py submission.json
   secrets:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
       - run: |
           curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar xz gitleaks
@@ -26,8 +26,8 @@ jobs:
     runs-on: ubuntu-latest
     defaults: { run: { working-directory: starter } }
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with: { node-version: 22 }
       - run: npm test
       - run: npm run e2e
@@ -37,7 +37,7 @@ jobs:
     name: Build & test your project (auto-detected)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Node (package.json at repo root)
         if: hashFiles('package.json') != ''
         run: |