diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index b75826b0..2010cce7 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout (full history — git-cliff needs all commits)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci-deep.yml b/.github/workflows/ci-deep.yml
index 50af5781..ba76825e 100644
--- a/.github/workflows/ci-deep.yml
+++ b/.github/workflows/ci-deep.yml
@@ -30,7 +30,7 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'ci:deep')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
@@ -60,7 +60,7 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'ci:deep')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Rust nightly (miri)
         uses: dtolnay/rust-toolchain@v1
         with:
@@ -85,7 +85,7 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'ci:deep')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Rust nightly (asan)
         uses: dtolnay/rust-toolchain@v1
         with:
@@ -110,7 +110,7 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'ci:deep')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Rust nightly (ubsan)
         uses: dtolnay/rust-toolchain@v1
         with:
@@ -138,7 +138,7 @@ jobs:
     timeout-minutes: 30
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Rust nightly (fuzz)
         uses: dtolnay/rust-toolchain@v1
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 629aaa0e..a5d3759a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
       cargo_deps: ${{ steps.filter.outputs.cargo_deps }}
       docker:     ${{ steps.filter.outputs.docker }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v4
         id: filter
         with:
@@ -63,7 +63,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.rust == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Rust nightly (rustfmt)
         uses: dtolnay/rust-toolchain@master
         with:
@@ -79,7 +79,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.cargo_deps == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
@@ -104,7 +104,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.rust == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: rui314/setup-mold@v1
       - uses: dtolnay/rust-toolchain@v1
         with:
@@ -140,7 +140,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.rust == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: ${{ env.RUST_TOOLCHAIN }}
@@ -161,7 +161,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.rust == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: rui314/setup-mold@v1
       - uses: dtolnay/rust-toolchain@v1
         with:
@@ -219,7 +219,7 @@ jobs:
     needs: [changes]
     if: github.ref == 'refs/heads/main' && needs.changes.outputs.rust == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: rui314/setup-mold@v1
       - uses: dtolnay/rust-toolchain@v1
         with:
@@ -241,7 +241,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.docker == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Build image (smoke)
diff --git a/.github/workflows/lint-actions.yml b/.github/workflows/lint-actions.yml
index 90bac0be..9efe9c9d 100644
--- a/.github/workflows/lint-actions.yml
+++ b/.github/workflows/lint-actions.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: actionlint
         uses: raven-actions/actionlint@v2
         with: