diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f70d35..011b62b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
       legacy_pg: ${{ steps.pg.outputs.legacy_pg }}
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Full history needed so BASE and HEAD below are both reachable
           # for `git diff`.
@@ -330,7 +330,7 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.pg }}
         run: pg-start ${{ matrix.pg }}
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install rsync and server headers
         # postgresql-server-dev-NN provides catalog/pg_class.h, which
         # test/gen-relkinds.sh reads for the relkind drift check in
@@ -393,7 +393,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Lint SQL
         run: make lint
 
@@ -408,7 +408,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Confirm ci.yml / claude-code-review.yml still match cancel-on-close.yml's assumptions
         run: |
           python3 - <<'PY'
@@ -550,7 +550,7 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.old_pg }}
         run: pg-start ${{ matrix.old_pg }}
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install rsync
         run: apt-get install -y rsync
       - name: Recreate old cluster with data checksums enabled
@@ -631,7 +631,7 @@ jobs:
           pg_ctlcluster 10 test start
           pg_isready -t 30
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install rsync
         # Must NOT install a newer server-dev yet: `make install` just below runs
         # with the DEFAULT pg_config, which must still resolve to PG10. Each newer
@@ -717,7 +717,7 @@ jobs:
       - name: Start PostgreSQL ${{ env.LEGACY_PG }}
         run: pg-start ${{ env.LEGACY_PG }}
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install rsync
         # No server-dev header package here: this job runs no suite (see the
         # job comment above), so nothing needs the relkind drift check.
@@ -793,7 +793,7 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.pg }}
         run: pg-start ${{ matrix.pg }}
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install rsync
         run: apt-get install -y rsync
       - name: Install pgtap (test harness dependency)
@@ -925,7 +925,7 @@ jobs:
       - name: Start PostgreSQL ${{ matrix.old_pg }}
         run: pg-start ${{ matrix.old_pg }}
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install rsync
         run: apt-get install -y rsync
       - name: Recreate old cluster with data checksums enabled
@@ -1023,7 +1023,7 @@ jobs:
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Verify all jobs are listed in needs
         # Ensures this job won't silently ignore a newly-added job that was
         # omitted from the needs list above.
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 3e12912..1d32307 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -137,7 +137,7 @@ jobs:
         # branch (master), never the fork's PR head. See the SECURITY note
         # above; anthropics/claude-code-action fetches the actual PR head
         # itself afterward via the base repo's `refs/pull/<N>/head` ref.
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 9a08bbb..dc559d1 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Checkout repository
         # Intentionally tracks the major-version tag (not a pinned SHA) so
         # upstream fixes are picked up automatically.
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
           persist-credentials: false