diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f583ee4..78b7837 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3f82c13..9aba9a8 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -26,7 +26,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
             - name: Set up Bun
               uses: oven-sh/setup-bun@v2
               with:
@@ -60,7 +60,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@v7
             - name: Set up Bun
               uses: oven-sh/setup-bun@v2
               with:
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index a40fc10..d5a483c 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # full history so gitleaks can scan all commits
       - name: gitleaks