diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6c95d1..eee5b7a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install zsh
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
@@ -77,7 +77,7 @@ jobs:
     timeout-minutes: 30
     container: swift:6.1-bookworm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Prepare SwiftPM exclude paths
         # Package.swift excludes build/ and Headless.app from the host target;
         # Dockerfile.linux creates them for the same reason.
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v7
         with:
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Sandboxed Chromium E2E
         run: ./apps/headless/Tests/linux-docker.sh
       - name: Upload QA evidence
@@ -122,7 +122,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build app
         run: ./apps/headless/build.sh
       - name: Protocol and security tests
@@ -139,7 +139,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install FFmpeg
         run: brew install ffmpeg
       - name: Build app
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9a03869..3d57ba5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
     needs: version
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install FFmpeg
         run: brew install ffmpeg
       - name: Build
@@ -47,7 +47,7 @@ jobs:
     needs: version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build
         run: HEADLESS_LINUX_PLATFORM=linux/amd64 ./apps/headless/build-linux.sh
       - name: E2E
@@ -67,7 +67,7 @@ jobs:
     needs: version
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build
         run: HEADLESS_LINUX_PLATFORM=linux/arm64 ./apps/headless/build-linux.sh
       - name: E2E