diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b4b41b..f9c78c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: pnpm/action-setup@v6
         with:
@@ -57,7 +57,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: pnpm/action-setup@v6
         with:
@@ -93,7 +93,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Pin a Swift 6 toolchain so Swift Testing (`import Testing`) is available
       # regardless of the runner image's default Xcode.
@@ -127,7 +127,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: pnpm/action-setup@v6
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2658059..a796d32 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,7 +58,7 @@ jobs:
       # signature production used by the auto-updater (latest.json).
       HAS_UPDATER_SIGNING: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY != '' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: pnpm/action-setup@v6
         with:
@@ -259,7 +259,7 @@ jobs:
       # build job. "true" iff the MAS signing identity is wired.
       HAS_MAS_SIGNING: ${{ secrets.MAS_APP_IDENTITY != '' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ env.HAS_MAS_SIGNING == 'true' }}
 
       - uses: pnpm/action-setup@v6
@@ -342,7 +342,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download both DMG artifacts
         uses: actions/download-artifact@v8