diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76e34cd32..3e9fe70e4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
             matrix:
                 php-version: ['8.2', '8.3', '8.4', '8.5']
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -76,7 +76,7 @@ jobs:
                     - { php-version: '8.4', symfony: '8.0.*', deps: 'lowest' }
                     - { php-version: '8.5', symfony: '8.*', deps: 'highest' }
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -155,7 +155,7 @@ jobs:
                     - { php-version: '8.4', laravel: '13.*', deps: 'lowest' }
                     - { php-version: '8.5', laravel: '13.*', deps: 'highest' }
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -211,7 +211,7 @@ jobs:
                     --health-timeout=5s
                     --health-retries=20
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -290,7 +290,7 @@ jobs:
                     # The most recent on the most recent.
                     - { php-version: '8.5', mageos: '3.4.0' }
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -380,7 +380,7 @@ jobs:
                     --health-cmd="curl -sf http://localhost:9200/_cluster/health || exit 1"
                     --health-interval=10s --health-timeout=5s --health-retries=30
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -491,7 +491,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 30
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -543,7 +543,7 @@ jobs:
         env:
             SYMFONY_REQUIRE: ${{ matrix.symfony }}
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -570,7 +570,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 30
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP
               uses: shivammathur/setup-php@v2
@@ -603,7 +603,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 30
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP with PCOV
               uses: shivammathur/setup-php@v2
@@ -631,7 +631,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 60
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Setup PHP (ext-grpc required)
               uses: shivammathur/setup-php@v2
@@ -732,7 +732,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 60
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Validate compose.yaml
               run: docker compose -f symfony/compose.yaml config --quiet
diff --git a/.github/workflows/docs-ovh.yml b/.github/workflows/docs-ovh.yml
index a489365a3..51779f7ef 100644
--- a/.github/workflows/docs-ovh.yml
+++ b/.github/workflows/docs-ovh.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/issue-trust-gate.yml b/.github/workflows/issue-trust-gate.yml
index 2a236d93e..6bc4f07a0 100644
--- a/.github/workflows/issue-trust-gate.yml
+++ b/.github/workflows/issue-trust-gate.yml
@@ -40,7 +40,7 @@ jobs:
     name: Label by author association
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Before touching the remote: the gate checks itself, offline. It decides what an autonomous
       # loop may read unsupervised, and "fails closed" is a claim worth a test rather than a
diff --git a/.github/workflows/php-grpc-images.yml b/.github/workflows/php-grpc-images.yml
index e30ef3995..930e97475 100644
--- a/.github/workflows/php-grpc-images.yml
+++ b/.github/workflows/php-grpc-images.yml
@@ -74,7 +74,7 @@ jobs:
                 # to load. Both are therefore necessary, neither one replaces the other.
                 flavour: [cli, cli-alpine, zts, zts-alpine]
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - uses: docker/setup-qemu-action@v3
               if: contains(inputs.platforms, 'arm64')
@@ -134,7 +134,7 @@ jobs:
         if: github.event_name != 'pull_request'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             # What decides fits in one function, and it is checked before being applied.
             # The case that matters: on publication Monday, `8.4-zts` and `8.4-zts-20260828`
diff --git a/.github/workflows/prises.yml b/.github/workflows/prises.yml
index e9adbed8e..23a78c1a9 100644
--- a/.github/workflows/prises.yml
+++ b/.github/workflows/prises.yml
@@ -34,7 +34,7 @@ jobs:
     name: Stale claims and titles
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Before querying the remote: the check checks itself, offline. Its first version declared a
       # live claim stale, and nothing had seen it coming.
diff --git a/.github/workflows/splitsh.yml b/.github/workflows/splitsh.yml
index c09f81bfe..fa36804f5 100644
--- a/.github/workflows/splitsh.yml
+++ b/.github/workflows/splitsh.yml
@@ -36,7 +36,7 @@ jobs:
             # *all* github.com HTTPS operations and breaks pushes to *other* repos with SPLITSH_PUSH_TOKEN
             # (symptom: git exits 128 / permission denied on satellite remotes).
             - name: Checkout (full history — required by splitsh)
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   persist-credentials: false