diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ffa9dc..63841db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
     name: Unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -62,7 +62,7 @@ jobs:
     name: Hook tests
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Run the hook suite
         run: sh tests/hook/run-tests.sh
@@ -71,7 +71,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: shellcheck
         run: shellcheck -s sh hooks/keypad-hook.sh tests/hook/run-tests.sh tools/package.sh
@@ -86,7 +86,7 @@ jobs:
     name: Manifest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Required fields, and rules the Marketplace enforces
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9da1a76..a04b5cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
           echo "::error::Release runs from main only; this was ${{ github.ref }}"
           exit 1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0        # tags and history, for the tag check and the notes