diff --git a/.github/workflows/alpine-repository.yml b/.github/workflows/alpine-repository.yml
index 940dfc1..75919d6 100644
--- a/.github/workflows/alpine-repository.yml
+++ b/.github/workflows/alpine-repository.yml
@@ -36,7 +36,7 @@ jobs:
           TOKEN: ${{ secrets.ALPINE_PUBLISH_TOKEN }}
         run: |
           if [ -n "$KEY" ] && [ -n "$TOKEN" ]; then echo enabled=true >> "$GITHUB_OUTPUT"; else echo 'Alpine publication skipped: configure ALPINE_SIGNING_KEY and ALPINE_PUBLISH_TOKEN.' >> "$GITHUB_STEP_SUMMARY"; fi
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: steps.credentials.outputs.enabled == 'true'
         with:
           ref: ${{ github.event.repository.default_branch }}
diff --git a/.github/workflows/apt-repository.yml b/.github/workflows/apt-repository.yml
index 2694f46..acc78a2 100644
--- a/.github/workflows/apt-repository.yml
+++ b/.github/workflows/apt-repository.yml
@@ -53,7 +53,7 @@ jobs:
           else
             echo 'APT publication skipped: configure APT_SIGNING_KEY and APT_SIGNING_PASSPHRASE.' >> "$GITHUB_STEP_SUMMARY"
           fi
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: steps.credentials.outputs.enabled == 'true'
         with:
           ref: ${{ github.event.repository.default_branch }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fa38f6b..d592284 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -33,7 +33,7 @@ jobs:
     name: Rust 1.85 compatibility
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.85.0
       - run: cargo test --locked
 
@@ -41,7 +41,7 @@ jobs:
     name: Website checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: 24
diff --git a/.github/workflows/opensuse-repository.yml b/.github/workflows/opensuse-repository.yml
index fa3ef12..76378b4 100644
--- a/.github/workflows/opensuse-repository.yml
+++ b/.github/workflows/opensuse-repository.yml
@@ -43,7 +43,7 @@ jobs:
           else
             echo 'openSUSE publication skipped: configure RPM_SIGNING_KEY, RPM_SIGNING_PASSPHRASE and RPM_PUBLISH_TOKEN.' >> "$GITHUB_STEP_SUMMARY"
           fi
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: steps.credentials.outputs.enabled == 'true'
         with:
           ref: ${{ github.event.repository.default_branch }}
diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml
index eab0e69..b845d08 100644
--- a/.github/workflows/packaging.yml
+++ b/.github/workflows/packaging.yml
@@ -24,7 +24,7 @@ jobs:
   native:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: actions/cache@v4
         id: tools
@@ -66,7 +66,7 @@ jobs:
   metadata:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: |
           set -euo pipefail
@@ -91,7 +91,7 @@ jobs:
     container: archlinux:base-devel
     steps:
       - run: pacman -Syu --noconfirm git zip
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: |
           set -euo pipefail
           useradd -m builder
@@ -121,7 +121,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: cachix/install-nix-action@v31
       - run: nix flake check
       - run: nix run . -- --version
@@ -139,7 +139,7 @@ jobs:
   opensuse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build and install from the static repository in Tumbleweed
         run: |
           set -euo pipefail
@@ -182,7 +182,7 @@ jobs:
   alpine:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build APK natively on Alpine
         run: |
           set -euo pipefail
@@ -208,7 +208,7 @@ jobs:
   snap:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: snapcore/action-build@v1
         id: build
       - run: |
@@ -223,7 +223,7 @@ jobs:
   flatpak:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: |
           set -euo pipefail
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index add1aff..046322f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
   version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -61,7 +61,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -174,7 +174,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download release artifacts
         uses: actions/download-artifact@v8
@@ -282,7 +282,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.ref_name }}
       - name: Set up Node.js for npm trusted publishing