diff --git a/.github/workflows/accessibility.yml b/.github/workflows/accessibility.yml
index 93a11285..68331511 100644
--- a/.github/workflows/accessibility.yml
+++ b/.github/workflows/accessibility.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: self-hosted
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 9445b6c2..06ea7dc4 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: self-hosted
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Generate version tag
         id: version
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index c6b61e20..32555bcf 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: self-hosted
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Run Trivy filesystem scan
         uses: aquasecurity/trivy-action@v0.36.0
@@ -59,7 +59,7 @@ jobs:
     needs: trivy-filesystem
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # This job builds a multi-GB GPU image on every run. Without reclaiming
       # space first, layers and build cache from previous runs fill the disk.
@@ -121,7 +121,7 @@ jobs:
     runs-on: self-hosted
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Audit against the Python version we actually ship (the container images
       # install python3.12). The runner's default python3 is 3.9, and resolving
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 0a4f8778..a0032f01 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -52,7 +52,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Test against the Python version we actually ship (the container images
       # install python3.12). The runner's default python3 is 3.9, where pip
@@ -135,7 +135,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Test against the Python version we actually ship (the container images
       # install python3.12). The runner's default python3 is 3.9, where pip
@@ -195,7 +195,7 @@ jobs:
     runs-on: self-hosted
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python virtual environment
         run: |