diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 602bfc5..4868b38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
       control_plane: ${{ steps.filter.outputs['control-plane'] }}
       gitleaks: ${{ steps.filter.outputs.gitleaks }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: filter
         uses: dorny/paths-filter@v4
         with:
@@ -51,7 +51,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.cli == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: "1.3" }
       - name: Cache bun
@@ -73,7 +73,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.dashboard_ui == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: "1.3" }
       - name: Cache bun
@@ -95,7 +95,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.ledger == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with: { workspaces: ledger }
@@ -108,7 +108,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.control_plane == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: control-plane/go.mod
@@ -147,7 +147,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.gitleaks == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
       - name: Install gitleaks
         env:
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index bc329b8..2e47aa7 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -23,7 +23,7 @@ jobs:
     name: build & push control-plane image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 01cfacd..de02b7e 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       version: ${{ steps.ver.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index b0246c7..613bcce 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -27,7 +27,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
 
       - uses: actions/setup-python@v6