diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5833df7..435fc626 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
     container:
       image: ghcr.io/astral-sh/uv:python3.12-bookworm-slim
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: uv sync --frozen --all-extras
       - run: uv run ruff check app/ tests/
       - run: uv run ruff format --check app/ tests/
@@ -36,7 +36,7 @@ jobs:
     container:
       image: ghcr.io/astral-sh/uv:python3.12-bookworm-slim
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: apt-get update && apt-get install -y --no-install-recommends ffmpeg
       - run: uv sync --frozen --all-extras
       - run: uv run pytest tests/ -q
@@ -46,7 +46,7 @@ jobs:
     container:
       image: node:20-alpine
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: for f in static/js/*.js; do node --check "$f"; done
 
   sast-bandit:
@@ -54,7 +54,7 @@ jobs:
     container:
       image: ghcr.io/astral-sh/uv:python3.12-bookworm-slim
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: uv tool install bandit
       - run: uv tool run bandit -r app/ -ll  # fail on medium+ severity
 
@@ -63,7 +63,7 @@ jobs:
     container:
       image: ghcr.io/astral-sh/uv:python3.12-bookworm-slim
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: uv tool install pip-audit
       - run: uv pip compile pyproject.toml -o /tmp/requirements.txt
       # Ignored CVEs (review when upgrading torch or demucs):
@@ -116,7 +116,7 @@ jobs:
   trivy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Scans the source tree for: known CVEs in deps, leaked secrets,
       # and Dockerfile / compose misconfigurations. Skips .venv (it can
       # be left over from earlier steps in the shared workspace; trivy
diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml
index 085c16ce..dec58c6c 100644
--- a/.github/workflows/linux-release.yml
+++ b/.github/workflows/linux-release.yml
@@ -33,7 +33,7 @@ jobs:
       - name: clean workspace
         run: rm -rf .build dist
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: install build dependencies
         env:
diff --git a/.github/workflows/macos-release.yml b/.github/workflows/macos-release.yml
index 54fb155e..91c2b965 100644
--- a/.github/workflows/macos-release.yml
+++ b/.github/workflows/macos-release.yml
@@ -24,7 +24,7 @@ jobs:
       - name: clean workspace
         run: rm -rf .build dist
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: write version files
         env:
diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml
index a29536c5..1a78b68a 100644
--- a/.github/workflows/windows-release.yml
+++ b/.github/workflows/windows-release.yml
@@ -30,7 +30,7 @@ jobs:
         run: |
           Remove-Item -Recurse -Force .build, dist -ErrorAction SilentlyContinue
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: write version files
         run: |