diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 211f4e6..9f6e50a 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -9,7 +9,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.14"
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [pre-commit]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
       - name: Generate documentation
         run: bazel build //docs:docs
@@ -164,7 +164,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
       - name: Create auth token file for action_file mode
         if: matrix.auth_token_path != ''
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b7f9ce5..1dc0eed 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,7 +15,7 @@ jobs:
   validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # TODO: Unfortunately it's not obvious how to restrict `workflow_dispatch` to a particular branch
       # so this step ensures releases are always done off of `main`.
       - name: Ensure branch is 'main'
@@ -46,7 +46,7 @@ jobs:
     needs: validation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Detect the current version
         run: |
           version="$(grep 'VERSION =' ${{ github.workspace }}/version.bzl | grep -o '[[:digit:].]\+')"
diff --git a/.github/workflows/update-digests.yml b/.github/workflows/update-digests.yml
index 5dff77e..cf82564 100644
--- a/.github/workflows/update-digests.yml
+++ b/.github/workflows/update-digests.yml
@@ -8,7 +8,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v3