diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 036c1d1..7a75465 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,11 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
+      # persist-credentials: false — no step here does authenticated git work,
+      # so leaving the token in .git/config is exposure with no upside.
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       # No toolchain action: rust-toolchain.toml is the single source of the
       # version, so CI and local builds cannot drift. Installing explicitly
@@ -45,7 +49,9 @@ jobs:
     name: clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Install pinned toolchain
         run: rustup toolchain install --no-self-update