diff --git a/.github/workflows/daily.wikiman.yml b/.github/workflows/daily.wikiman.yml
index f5f9b1e19..74843547b 100644
--- a/.github/workflows/daily.wikiman.yml
+++ b/.github/workflows/daily.wikiman.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
       - name: copy pacman.yaml
         run: cp pacman.yaml current-pacman.yaml
       - name: write GH action token to file
diff --git a/.github/workflows/docker.build.yml b/.github/workflows/docker.build.yml
index 365cbc98a..56de7e163 100644
--- a/.github/workflows/docker.build.yml
+++ b/.github/workflows/docker.build.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
       -
         name: Docker meta
         id: docker_meta
@@ -58,14 +58,14 @@ jobs:
       -
         name: Check out `wmde/wbaas-deploy` repository in staging child directory
         if: github.event_name != 'pull_request'
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
         with:
           repository: wmde/wbaas-deploy
           path: ./repos/wbaas-deploy-staging
       -
         name: Check out `wmde/wbaas-deploy` repository in production child directory
         if: github.event_name != 'pull_request'
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
         with:
           repository: wmde/wbaas-deploy
           path: ./repos/wbaas-deploy-production
diff --git a/.github/workflows/docker.lint.yml b/.github/workflows/docker.lint.yml
index 42fdbd300..cf74a13e4 100644
--- a/.github/workflows/docker.lint.yml
+++ b/.github/workflows/docker.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
       - name: lint
         uses: hadolint/hadolint-action@v3.5.0
         with:
diff --git a/.github/workflows/github.prs.combine.yml b/.github/workflows/github.prs.combine.yml
index a4a8f5c62..bea265171 100644
--- a/.github/workflows/github.prs.combine.yml
+++ b/.github/workflows/github.prs.combine.yml
@@ -93,7 +93,7 @@ jobs:
             console.log('Combined: ' + combined);
             return combined
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v4.1.0
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_TOKEN_PLUSW }}
diff --git a/.github/workflows/mediawiki.verify.yml b/.github/workflows/mediawiki.verify.yml
index 890a5d04b..b4e588573 100644
--- a/.github/workflows/mediawiki.verify.yml
+++ b/.github/workflows/mediawiki.verify.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
       - name: build docker
         run: docker compose up -d
       - name: Wait for server to accept connections
diff --git a/.github/workflows/wbstack.php.lint.yml b/.github/workflows/wbstack.php.lint.yml
index 0cbf0d4ba..f180deca7 100644
--- a/.github/workflows/wbstack.php.lint.yml
+++ b/.github/workflows/wbstack.php.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
 
       - uses: shivammathur/setup-php@v2
         with:
diff --git a/.github/workflows/wbstack.python.lint.yml b/.github/workflows/wbstack.python.lint.yml
index 0f6201fef..e838f6de0 100644
--- a/.github/workflows/wbstack.python.lint.yml
+++ b/.github/workflows/wbstack.python.lint.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@v7
diff --git a/.github/workflows/wbstack.sync.check.yml b/.github/workflows/wbstack.sync.check.yml
index 45ea46d87..642ab38c5 100644
--- a/.github/workflows/wbstack.sync.check.yml
+++ b/.github/workflows/wbstack.sync.check.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
       - name: run sync
         run: ./sync.sh
       - name: Show `git diff` output
diff --git a/.github/workflows/wbstack.sync.trigger.yml b/.github/workflows/wbstack.sync.trigger.yml
index 9c3412a38..95f41d904 100644
--- a/.github/workflows/wbstack.sync.trigger.yml
+++ b/.github/workflows/wbstack.sync.trigger.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.event.inputs.branch }}
       - name: run sync
diff --git a/.github/workflows/wbstack.yaml.lint.yml b/.github/workflows/wbstack.yaml.lint.yml
index f4a75d954..086075fc8 100644
--- a/.github/workflows/wbstack.yaml.lint.yml
+++ b/.github/workflows/wbstack.yaml.lint.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.0
+      - uses: actions/checkout@v7.0.1
 
       - name: yamllint
         uses: ibiqlik/action-yamllint@v3
diff --git a/.github/workflows/wikiman.validate.yml b/.github/workflows/wikiman.validate.yml
index 35910089f..bd04b5298 100644
--- a/.github/workflows/wikiman.validate.yml
+++ b/.github/workflows/wikiman.validate.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.0
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v3