diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml
index 0052b08..9a55164 100644
--- a/.github/workflows/build-pr.yml
+++ b/.github/workflows/build-pr.yml
@@ -37,7 +37,7 @@ jobs:
       run:
         working-directory: ui
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # There is no root package.json; packageManager lives in ui/package.json, and
       # `defaults.run.working-directory` does not apply to action inputs, so the action
       # has to be told where to read the pnpm version from.
@@ -64,7 +64,7 @@ jobs:
   helm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: azure/setup-helm@v5
         with:
           # Pinned on purpose: the schema checks below grep for JSON-Pointer paths
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 580fe53..8a8e2ba 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -45,7 +45,7 @@ jobs:
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         # Only the dispatch path needs a working tree, to read the manifest fallback below.
         # release-please-action works purely through the API and needs no checkout.
         if: github.event_name == 'workflow_dispatch'
@@ -241,7 +241,7 @@ jobs:
       # returns 403 and the sign step fails. Same grant the six image jobs already carry.
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: azure/setup-helm@v5
         with:
           # Same pin, same reason as build-pr.yml (see the comment there): the chart that ships