diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 280ec227..0fcb84ed 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,7 +40,7 @@ jobs:
       CCACHE_DIR: ${{ github.workspace }}/.ccache
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # actions/checkout writes its own safe.directory, but later steps
       # invoke git from a fresh shell (`sh -e {0}`) where that scoped
diff --git a/.github/workflows/devcontainer-image.yml b/.github/workflows/devcontainer-image.yml
index 48d383c6..69bc04f7 100644
--- a/.github/workflows/devcontainer-image.yml
+++ b/.github/workflows/devcontainer-image.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v4
 
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 7858ae5e..043d4e62 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Later steps run git from a fresh `sh -e {0}` shell where
       # checkout's scoped safe.directory is not always picked up; set it