diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 01b49c2..3e8f590 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
     name: build + test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with: { persist-credentials: false }
       - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
diff --git a/.github/workflows/contract.yml b/.github/workflows/contract.yml
index b624c88..aa63398 100644
--- a/.github/workflows/contract.yml
+++ b/.github/workflows/contract.yml
@@ -31,7 +31,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with: { persist-credentials: false }
       - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
diff --git a/.github/workflows/on-bitrouter-release.yml b/.github/workflows/on-bitrouter-release.yml
index 14ca8d0..3bac05c 100644
--- a/.github/workflows/on-bitrouter-release.yml
+++ b/.github/workflows/on-bitrouter-release.yml
@@ -36,7 +36,7 @@ jobs:
       tag: ${{ steps.detect.outputs.tag }}
       fresh: ${{ steps.detect.outputs.fresh }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with: { persist-credentials: false }
       - id: detect
         env:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ceed9ad..720386f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -28,7 +28,7 @@ jobs:
       # this workflow from this commit, which is checkable by anyone.
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
           persist-credentials: false