diff --git a/.github/workflows/cd.installer.yml b/.github/workflows/cd.installer.yml
index 8578cd5..66dc6a1 100644
--- a/.github/workflows/cd.installer.yml
+++ b/.github/workflows/cd.installer.yml
@@ -15,7 +15,7 @@ jobs:
     if: github.repository == 'pkgxdev/mash'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
diff --git a/.github/workflows/cd.www.yml b/.github/workflows/cd.www.yml
index 010280c..54592ab 100644
--- a/.github/workflows/cd.www.yml
+++ b/.github/workflows/cd.www.yml
@@ -23,7 +23,7 @@ jobs:
     if: github.repository == 'pkgxdev/mash'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pkgxdev/setup@v5
 
       - name: trawl
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index dbe0105..158d2bd 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'pkgxdev/mash'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: fischerscode/tagger@v0
         with:
           prefix: v
@@ -29,7 +29,7 @@ jobs:
     if: github.repository == 'pkgxdev/mash'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: version
         run: sed -i "s/mash 0.0.0-dev/mash ${{ github.event.release.tag_name }}/g" ./mash
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ee4dc4..e80ba5b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
     if: github.repository == 'pkgxdev/mash'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pkgxdev/setup@v5
       - run: ./mash demo test-pattern
       - run: ./mash demo test-pattern           # check cache route works too