diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 35090a0..d9c3219 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
     # is reported but doesn't block merging.
     continue-on-error: ${{ matrix.os == 'windows-latest' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:
@@ -53,7 +53,7 @@ jobs:
   network-boundary:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: internal/update must be the only package touching the network
         run: |
           hits="$(grep -rl --include='*.go' -e '"net/http"' -e '"net"$' . \
@@ -68,6 +68,6 @@ jobs:
   shellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: shellcheck install.sh
         run: shellcheck install.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 270e67d..5e0f402 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0