diff --git a/.github/workflows/move-major-tag.yml b/.github/workflows/move-major-tag.yml
index d279f17..13c3380 100644
--- a/.github/workflows/move-major-tag.yml
+++ b/.github/workflows/move-major-tag.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Force-move major tag
         run: |
diff --git a/.github/workflows/prebuild-all.yml b/.github/workflows/prebuild-all.yml
index f15c2fb..2ab7015 100644
--- a/.github/workflows/prebuild-all.yml
+++ b/.github/workflows/prebuild-all.yml
@@ -143,13 +143,13 @@ jobs:
       # resolves against the workspace root. `persist-credentials: false`
       # keeps the caller's GITHUB_TOKEN off disk — see the comment in
       # prebuild.yml.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       # Same-ref harness checkout — see the comment in prebuild.yml.
       - name: Checkout prebuild harness
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index 1fa71be..51cc4de 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -97,7 +97,7 @@ jobs:
       # keeps the caller's GITHUB_TOKEN out of $GITHUB_WORKSPACE/.git/config
       # so the untrusted `npm install` of the target module (with lifecycle
       # scripts) below can't read a (release-write-capable) token off disk.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -107,7 +107,7 @@ jobs:
       # workflow version — no @main pin that can drift from tagged
       # callers, and branch dispatches test in-flight action changes.
       - name: Checkout prebuild harness
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml
index ed36e96..ff86078 100644
--- a/.github/workflows/test-android.yml
+++ b/.github/workflows/test-android.yml
@@ -136,10 +136,10 @@ jobs:
           fi
 
       - name: Checkout caller repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Checkout test harness
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ inputs.harness_ref || job.workflow_sha }}
diff --git a/.github/workflows/test-ios.yml b/.github/workflows/test-ios.yml
index c816678..fd20471 100644
--- a/.github/workflows/test-ios.yml
+++ b/.github/workflows/test-ios.yml
@@ -99,10 +99,10 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout caller repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Checkout test harness
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ inputs.harness_ref || job.workflow_sha }}