diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 180f30b..3deeb2a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     name: Bash and smoke test
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Verify executable entrypoints from a clean checkout
         run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c970876..e993578 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ jobs:
     name: Analyze GitHub Actions workflows
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
       - name: Perform CodeQL analysis
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 9f26df0..d58dedd 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -24,7 +24,7 @@ jobs:
     name: Check local documentation links
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/release-metadata.yml b/.github/workflows/release-metadata.yml
index 98dc899..6d0e7aa 100644
--- a/.github/workflows/release-metadata.yml
+++ b/.github/workflows/release-metadata.yml
@@ -12,7 +12,7 @@ jobs:
     name: Verify release version and tag
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Verify version, CLI, changelog, and tag
         shell: bash
         run: |
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 45e19e6..1bc0b38 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -39,6 +39,6 @@ jobs:
           retention-days: 5
 
       - name: Publish Code Scanning results
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif