diff --git a/.github/workflows/capability-drift.yml b/.github/workflows/capability-drift.yml
index f61dd86..6ac25ff 100644
--- a/.github/workflows/capability-drift.yml
+++ b/.github/workflows/capability-drift.yml
@@ -51,7 +51,7 @@ jobs:
       PROBE_NAME: tf-ci-probe-${{ github.run_id }}-${{ github.run_attempt }}
       LIVE_NAME: tf-ci-live-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
@@ -130,7 +130,7 @@ jobs:
     # capability change, and vice versa. Both must pass; neither may skip.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
@@ -160,7 +160,7 @@ jobs:
     # and the first thing to do with one is pin it into a unit test with the base64 case.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8da256c..6c3baee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       matrix:
         node: ['22', '24']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
@@ -49,7 +49,7 @@ jobs:
     # searches new ground runs on a schedule, in capability-drift.yml.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b1166f3..1cfed2a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '24'