diff --git a/.github/workflows/check-record.yml b/.github/workflows/check-record.yml
index 489e2d4..3cc7382 100644
--- a/.github/workflows/check-record.yml
+++ b/.github/workflows/check-record.yml
@@ -18,7 +18,7 @@ jobs:
     if: contains(github.event.issue.labels.*.name, 'check-record')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # applyCheck recomputes a translation's source blob hash, which needs
           # real history rather than a shallow clone.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b44e65a..7b1482f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # check-translations compares against the English source's blob hash,
           # which needs real history rather than a shallow clone.
@@ -57,6 +57,6 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: VPN certificate chain still behaves as documented
         run: npm run check:vpn-chain
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index cbfe767..6f1c0e2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -20,7 +20,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # lastUpdated timestamps come from git history.
           fetch-depth: 0
diff --git a/.github/workflows/drift.yml b/.github/workflows/drift.yml
index a74b462..006cafa 100644
--- a/.github/workflows/drift.yml
+++ b/.github/workflows/drift.yml
@@ -20,7 +20,7 @@ jobs:
   vpn-chain:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
@@ -58,7 +58,7 @@ jobs:
   fact-urls:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
@@ -95,7 +95,7 @@ jobs:
   content-urls:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
@@ -133,7 +133,7 @@ jobs:
   staleness:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc