diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml
index 3839971..151a509 100644
--- a/.github/workflows/_lint.yml
+++ b/.github/workflows/_lint.yml
@@ -5,7 +5,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/_release.yml b/.github/workflows/_release.yml
index 881229e..40d500f 100644
--- a/.github/workflows/_release.yml
+++ b/.github/workflows/_release.yml
@@ -10,7 +10,7 @@ jobs:
       # a build artifact). Check it out into a dot-dir — the `files: "*"` glob below
       # only sees the cwd root and skips leading-dot paths — then copy just that file
       # to the root, so the upload is exactly {version-switcher.mjs, docs.zip}.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: .src
           sparse-checkout: plugins/version-switcher.mjs
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index cbde4d8..bffc936 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -5,6 +5,6 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Unit tests (widget logic + make-switcher parity)
         run: npm test
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index f3e4960..f73ee6b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -51,7 +51,7 @@ jobs:
     outputs:
       version-name: ${{ steps.ver.outputs.version-name }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       # uv is installed unconditionally (Node/npx is already on the runner) so every
       # docs build has the same baseline env regardless of build-command. With no
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 978a19a..d66affe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -83,7 +83,7 @@ jobs:
     steps:
       # The CONSUMER's repo, at the root cwd: assemble.mjs runs `git tag` here to
       # order that repo's deployed versions, so it needs their tags (fetch-depth: 0).
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -92,7 +92,7 @@ jobs:
       # consumer pinned publish.yml@<ref> to — automatically, no version bump.
       # Sparse: only assemble/ is needed.
       - name: Fetch assemble scripts
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}