diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c419f2..6b2b57e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,9 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       # Pinned to the packageManager version, not "latest". bun.lock was
       # resolved by this version, and a newer bun can dedupe transitive
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1164242..7adef08 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,9 @@ jobs:
     # distinguish, and approving costs one click.
     environment: npm-publish
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       # Pinned to the packageManager version — see the note in ci.yml.
       - uses: oven-sh/setup-bun@v2
@@ -40,7 +42,7 @@ jobs:
       # configured — npm detects the OIDC environment and uses trusted
       # publishing instead. package-manager-cache is off because a restored npm
       # cache can shadow the CLI upgrade below.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           # Trusted publishing requires Node >= 22.14.0; "22" resolves to the
           # latest 22.x, which satisfies that floor.