diff --git a/.github/workflows/cli-auth-smoke.yml b/.github/workflows/cli-auth-smoke.yml
index a8b4ae93..a328ab19 100644
--- a/.github/workflows/cli-auth-smoke.yml
+++ b/.github/workflows/cli-auth-smoke.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node
         uses: actions/setup-node@v6
diff --git a/.github/workflows/cli-ci.yml b/.github/workflows/cli-ci.yml
index efc17aaf..535f54c3 100644
--- a/.github/workflows/cli-ci.yml
+++ b/.github/workflows/cli-ci.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index 9711e7fb..8ab08123 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index aff2be42..6a4e59b9 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout petdex
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Manual workflow_dispatch must build from inputs.tag, not from
           # the branch the workflow file lives on. Tag pushes already
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout petdex
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -102,7 +102,7 @@ jobs:
     runs-on: windows-2022
     steps:
       - name: Checkout petdex
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -151,7 +151,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout petdex
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
diff --git a/.github/workflows/manifest-snapshot.yml b/.github/workflows/manifest-snapshot.yml
index 8fd92b66..49741743 100644
--- a/.github/workflows/manifest-snapshot.yml
+++ b/.github/workflows/manifest-snapshot.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Always run reviewed code from the default branch. A manual
           # dispatch can target any ref, and this job holds prod R2 write
diff --git a/.github/workflows/preview-snapshot.yml b/.github/workflows/preview-snapshot.yml
index 6984848e..d813d0f2 100644
--- a/.github/workflows/preview-snapshot.yml
+++ b/.github/workflows/preview-snapshot.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Always run reviewed code from the default branch. A manual
           # dispatch can target any ref, and this job holds prod R2 write