diff --git a/.github/workflows/benchmarks.yaml b/.github/workflows/benchmarks.yaml
index addda47..7d756bc 100644
--- a/.github/workflows/benchmarks.yaml
+++ b/.github/workflows/benchmarks.yaml
@@ -32,7 +32,7 @@ jobs:
       contents: read
       pull-requests: write # no-op on fork PRs (read-only token); comment step is guarded
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # hatch-vcs + checkout of the base revision
           persist-credentials: false # benchmarks execute PR code; keep the token out of .git/config
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 145ed6f..c7c8351 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/ruff-action@v3
       - run: ruff check --output-format=github
       - run: ruff format --diff
@@ -22,7 +22,7 @@ jobs:
     name: Type check
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -48,7 +48,7 @@ jobs:
       matrix:
         python-version: ["3.11", "3.14"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -75,7 +75,7 @@ jobs:
     name: Build docs
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index ae8f4ad..c6a6aa1 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -22,7 +22,7 @@ jobs:
       name: pypi
       url: https://pypi.org/project/tsam_xarray
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
@@ -46,7 +46,7 @@ jobs:
     if: github.event_name == 'push' && needs.publish.result == 'success'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref_name }}