diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f61a880..8a93ee7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,7 +95,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: 🔧 Setup Go toolchain
         uses: actions/setup-go@v5
@@ -133,7 +133,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # The e2e rig runs Ubuntu 26.04 ONLY - a deliberate choice, because a
       # structural defect shows up on every release and three distro legs mostly
@@ -174,7 +174,7 @@ jobs:
         # submodules: recursive brings in tests/helper/bats-core. Without it the
         # Makefile would try `git submodule update` against a checkout that has
         # no credentials for it, and the failure reads as a bats bug.
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 3dc72de..78d5e31 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -131,7 +131,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -193,7 +193,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -256,7 +256,7 @@ jobs:
 
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive