diff --git a/.github/workflows/lint-meta.yml b/.github/workflows/lint-meta.yml
index 153d883..38bf4f6 100644
--- a/.github/workflows/lint-meta.yml
+++ b/.github/workflows/lint-meta.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: actions/setup-node@v5
@@ -40,7 +40,7 @@ jobs:
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
-          # actions/checkout@v6 above already clones full history
+          # actions/checkout@v7 above already clones full history
           # (fetch-depth: 0); we only need the base ref locally so
           # commitlint can resolve the "from" symbol.
           git fetch origin "$BASE_REF"
@@ -53,7 +53,7 @@ jobs:
     name: Markdown
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '24'
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 1035109..68ce282 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -17,7 +17,7 @@ jobs:
     name: Cargo Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pinned to master HEAD (commit 858dc40, 2026-03-20); see same
       # comment in build.yml — the v2 ref still ships Node 20.
       - uses: rustsec/audit-check@858dc40f52ca2b8570b7a997c1c4e35c6fc9a432
@@ -28,14 +28,14 @@ jobs:
     name: Cargo Deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2
 
   codeql:
     name: CodeQL
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v4
         with:
           languages: rust