diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 22dbaa6..29414de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
       matrix:
         python: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/codex.yml b/.github/workflows/codex.yml
index bc2ef2a..8088d34 100644
--- a/.github/workflows/codex.yml
+++ b/.github/workflows/codex.yml
@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: refs/pull/${{ github.event.issue.number }}/merge
           persist-credentials: false
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 150b6f2..6833a5a 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -16,7 +16,7 @@ jobs:
     name: recall eval
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/install-sh.yml b/.github/workflows/install-sh.yml
index 066ea25..cbf5873 100644
--- a/.github/workflows/install-sh.yml
+++ b/.github/workflows/install-sh.yml
@@ -38,7 +38,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Don't leave the token sitting in .git/config after checkout —
           # a leaked credentials file would otherwise allow pushing back.
@@ -58,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: lint
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/schema-check.yml b/.github/workflows/schema-check.yml
index 4d6f175..c16950b 100644
--- a/.github/workflows/schema-check.yml
+++ b/.github/workflows/schema-check.yml
@@ -15,7 +15,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with: