diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index f8fdb09..1a1b76d 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -20,7 +20,7 @@ jobs:
     name: Criterion benches
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.97.1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 53331db..99d8b3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
     name: Rust lints & tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.97.1
@@ -51,7 +51,7 @@ jobs:
     name: JS typecheck & tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -211,7 +211,7 @@ jobs:
     name: Release-profile tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -302,7 +302,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
@@ -440,7 +440,7 @@ jobs:
             build: pnpm build:napi --target aarch64-unknown-linux-musl --use-napi-cross
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Host tooling only for non-docker targets (see release.yml).
       - name: Setup pnpm
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 6990b58..b4f4341 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -28,7 +28,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Configure Pages
         uses: actions/configure-pages@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 04a80b1..eb773f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -80,7 +80,7 @@ jobs:
             build: pnpm build:napi --target aarch64-unknown-linux-musl --release --use-napi-cross
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Host tooling only for non-docker targets. Docker images ship their own
       # Node/Rust; skipping host pnpm cache avoids post-step path errors when
@@ -172,7 +172,7 @@ jobs:
       contents: read
       id-token: write # required for npm OIDC trusted publishing
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
diff --git a/.github/workflows/smoke-published.yml b/.github/workflows/smoke-published.yml
index 78245a6..e847c88 100644
--- a/.github/workflows/smoke-published.yml
+++ b/.github/workflows/smoke-published.yml
@@ -119,7 +119,7 @@ jobs:
             image: node:20-alpine
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The Alpine image already ships Node 20; setup-node here would install a
       # glibc build on the host and defeat the point of the musl jobs.