diff --git a/.github/workflows/auto-changelog-fragment.yml b/.github/workflows/auto-changelog-fragment.yml
index 4c7ae3c..ebaf79a 100644
--- a/.github/workflows/auto-changelog-fragment.yml
+++ b/.github/workflows/auto-changelog-fragment.yml
@@ -42,7 +42,7 @@ jobs:
       !contains(github.event.pull_request.labels.*.name, 'skip-changelog') &&
       !startsWith(github.event.pull_request.head.ref, 'release-prep/')
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           # For same-repo PRs check out the head branch so we can commit + push
           # a fragment. For forks this ref is still readable for the check step.
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index bb5aca7..1d5442d 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -28,7 +28,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -46,7 +46,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, lint]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, lint]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/ff-merge-check.yml b/.github/workflows/ff-merge-check.yml
index 12cb80b..e4c5b44 100644
--- a/.github/workflows/ff-merge-check.yml
+++ b/.github/workflows/ff-merge-check.yml
@@ -37,7 +37,7 @@ jobs:
             }
 
       - name: Checkout repo
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ff-merge-do.yml b/.github/workflows/ff-merge-do.yml
index 1ced722..9b31c7f 100644
--- a/.github/workflows/ff-merge-do.yml
+++ b/.github/workflows/ff-merge-do.yml
@@ -25,7 +25,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.FF_MERGE_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d955e35..90d6298 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,7 +12,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
       - name: Run actionlint
         uses: raven-actions/actionlint@v2
         with:
diff --git a/.github/workflows/main-pre-merge-gate.yml b/.github/workflows/main-pre-merge-gate.yml
index 548d369..1d18f16 100644
--- a/.github/workflows/main-pre-merge-gate.yml
+++ b/.github/workflows/main-pre-merge-gate.yml
@@ -45,7 +45,7 @@ jobs:
           exit 1
 
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/python-build.yml b/.github/workflows/python-build.yml
index 4d1850c..52b32d3 100644
--- a/.github/workflows/python-build.yml
+++ b/.github/workflows/python-build.yml
@@ -24,7 +24,7 @@ jobs:
     name: Build sdist and wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index 17c666b..ff6e48c 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -16,7 +16,7 @@ jobs:
     name: Sync notes from CHANGELOG.md
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           ref: main
           fetch-depth: 0
diff --git a/.github/workflows/release-prep.yml b/.github/workflows/release-prep.yml
index eaba4ba..e32271d 100644
--- a/.github/workflows/release-prep.yml
+++ b/.github/workflows/release-prep.yml
@@ -40,7 +40,7 @@ jobs:
     # "Allow GitHub Actions to create and approve pull requests" is off.
     environment: ff_merge
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.1
         with:
           ref: dev
           fetch-depth: 0