diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bffa2d2..fef8dc1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: macos-26            # Xcode 26 / macOS 26 SDK, required for the Liquid Glass APIs
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select latest Xcode
         run: sudo xcode-select -switch /Applications/Xcode.app && swift --version
@@ -40,7 +40,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c2681ea..d5c3104 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
             os: ubuntu-latest
             build-mode: none
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select latest Xcode
         if: matrix.language == 'swift'
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index fe5dfe4..3d5b6e5 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Review dependencies
         uses: actions/dependency-review-action@v4
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index ea3a9ff..657532c 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -17,7 +17,7 @@ jobs:
   build:
     runs-on: macos-26            # Xcode 16 / Swift 6, matches the dev toolchain
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select latest Xcode
         run: sudo xcode-select -switch /Applications/Xcode.app && swift --version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aaa87e0..d0a070e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
   build:
     runs-on: macos-26            # Xcode 16 / Swift 6, matches the dev toolchain
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select latest Xcode
         run: sudo xcode-select -switch /Applications/Xcode.app && swift --version
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index b533b7d..3a7a948 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # full history so historical leaks are caught too