diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8415e13..81cd3cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref || github.ref_name }}
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
@@ -51,7 +51,7 @@ jobs:
   sam-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: aws-actions/setup-sam@v2
         with:
           use-installer: true
@@ -63,7 +63,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
diff --git a/.github/workflows/deploy-aws.yml b/.github/workflows/deploy-aws.yml
index a393136..f0e45b1 100644
--- a/.github/workflows/deploy-aws.yml
+++ b/.github/workflows/deploy-aws.yml
@@ -23,7 +23,7 @@ jobs:
     if: vars.DEPLOY_TARGET != 'gcp'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
diff --git a/.github/workflows/deploy-gcp.yml b/.github/workflows/deploy-gcp.yml
index 172fc48..ee12019 100644
--- a/.github/workflows/deploy-gcp.yml
+++ b/.github/workflows/deploy-gcp.yml
@@ -25,7 +25,7 @@ jobs:
     if: vars.DEPLOY_TARGET == 'gcp'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Workload Identity Federation: authenticate without a key file
       # - uses: google-github-actions/auth@v2