diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd4e316..bb51ef9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ jobs:
     name: "IntentProof CI: Build and Test"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -28,11 +28,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # pins.spec_ref may be an ancestor of HEAD; shallow PR clones omit it.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: IntentProof/intentproof-tools
           ref: main
@@ -63,19 +63,19 @@ jobs:
           write('sdk_go_ref', sha('intentproof-sdk-go'));
           NODE
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: IntentProof/intentproof-sdk-node
           ref: ${{ steps.ecosystem_pins.outputs.sdk_node_ref }}
           path: intentproof-sdk-node
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: IntentProof/intentproof-sdk-python
           ref: ${{ steps.ecosystem_pins.outputs.sdk_python_ref }}
           path: intentproof-sdk-python
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: IntentProof/intentproof-sdk-go
           ref: ${{ steps.ecosystem_pins.outputs.sdk_go_ref }}
@@ -100,9 +100,9 @@ jobs:
     name: "IntentProof CI: Counterparty Golden"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: IntentProof/intentproof-tools
           ref: main
diff --git a/.github/workflows/release-spec.yml b/.github/workflows/release-spec.yml
index 3e70c68..11972b3 100644
--- a/.github/workflows/release-spec.yml
+++ b/.github/workflows/release-spec.yml
@@ -31,7 +31,7 @@ jobs:
     name: "IntentProof Release: Test Spec"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}
 
@@ -54,7 +54,7 @@ jobs:
       release_ref: ${{ steps.release.outputs.release_ref }}
       release_version: ${{ steps.release.outputs.release_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}
 
@@ -117,7 +117,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.generate.outputs.release_ref }}
 
@@ -171,7 +171,7 @@ jobs:
       - cosign
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.generate.outputs.release_ref }}
 
@@ -223,7 +223,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0