diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81660b3..2b8655b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
     steps:
       - name: Install ucode and tooling
         run: apk add --no-cache ucode make grep findutils
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Unit tests
         run: make test-unit
       - name: Property-fuzz pass (high iter)
@@ -61,7 +61,7 @@ jobs:
     steps:
       - name: Install ucode and tooling
         run: apk add --no-cache ucode make grep findutils
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Lint (em-dash + ucode syntax + reserved-name guard)
         run: make lint
       - name: OpenAPI contract is up to date
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [unit, lint]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install QEMU and SSH client
         run: |
@@ -135,7 +135,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # need tag object for verify-tag
 
@@ -323,7 +323,7 @@ jobs:
           - arch: mips_24kc
             sdk_url: https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/openwrt-sdk-25.12.4-ath79-generic_gcc-14.3.0_musl.Linux-x86_64.tar.zst
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install tooling
         run: |