diff --git a/.github/workflows/canon-audit.yml b/.github/workflows/canon-audit.yml
index 7f62b3b..572bbdb 100644
--- a/.github/workflows/canon-audit.yml
+++ b/.github/workflows/canon-audit.yml
@@ -12,7 +12,7 @@ jobs:
   canon-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Self-test (audit's own pattern set still detects every shape)
         run: bash scripts/canon_audit.sh --self-test
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5d00265..0f5a666 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -76,7 +76,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -100,7 +100,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 23c3c4d..c4368d1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -33,7 +33,7 @@ jobs:
       id-token: write       # OIDC for the build-provenance attestation
       attestations: write   # actions/attest-build-provenance
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: '3.12'