diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b98c170..0e81689 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
         node: [22, 24]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/compat.yml b/.github/workflows/compat.yml
index 813baf5..42c776c 100644
--- a/.github/workflows/compat.yml
+++ b/.github/workflows/compat.yml
@@ -18,7 +18,7 @@ jobs:
   bare-import:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v4
         with:
           version: 11.7.0
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v4
         with:
           version: 11.7.0
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 6dccfbe..7b49138 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -89,7 +89,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v4
         with:
           version: 11.7.0
diff --git a/.github/workflows/peer-range.yml b/.github/workflows/peer-range.yml
index feec765..e4e1c52 100644
--- a/.github/workflows/peer-range.yml
+++ b/.github/workflows/peer-range.yml
@@ -27,7 +27,7 @@ jobs:
     name: canonical range admits the published dist-tags
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.github/workflows/plugin-doctor.yml b/.github/workflows/plugin-doctor.yml
index 7d2bc31..6ecf50b 100644
--- a/.github/workflows/plugin-doctor.yml
+++ b/.github/workflows/plugin-doctor.yml
@@ -26,7 +26,7 @@ jobs:
     name: dsh-plugin-doctor (static R/K)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: 22
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6dac915..30d506d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v4
         with:
           version: 11.7.0
@@ -77,7 +77,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Create the GitHub Release from the CHANGELOG
         env:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3e85d18..2f3b397 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -19,7 +19,7 @@ jobs:
       id-token: write
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: "Run analysis"