diff --git a/.github/workflows/cd-registry-cli.yml b/.github/workflows/cd-registry-cli.yml
index 9bca622..60b6072 100644
--- a/.github/workflows/cd-registry-cli.yml
+++ b/.github/workflows/cd-registry-cli.yml
@@ -57,7 +57,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
       - if: runner.os == 'Linux'
diff --git a/.github/workflows/pg-atlas-sbom.yml b/.github/workflows/pg-atlas-sbom.yml
index 8005c3a..cf8c914 100644
--- a/.github/workflows/pg-atlas-sbom.yml
+++ b/.github/workflows/pg-atlas-sbom.yml
@@ -17,6 +17,6 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Fetch and submit SBOM
         uses: SCF-Public-Goods-Maintenance/pg-atlas-sbom-action@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cc130f7..2999c83 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index e18520c..53b7388 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -25,7 +25,7 @@ jobs:
     name: Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: rustup update
       - run: rustup target add wasm32v1-none
       - run: rustup component add rustfmt clippy
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index dcb7b62..378e5e5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,7 +24,7 @@ jobs:
       CI_CACHE: "/tmp/.cache"
       CI_BUILD: "--locked"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install system dependencies
         run: |
           sudo apt-get update
@@ -42,7 +42,7 @@ jobs:
       # the hello_v1/v2 fixtures are local (crates/stellar-registry-test/
       # fixtures/contracts) and build with the CLI. Assemble both into the dir.
       - name: Checkout stellar-registry/contracts
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: stellar-registry/contracts
           path: _contracts
@@ -97,7 +97,7 @@ jobs:
       STELLAR_ACCOUNT: default
       STELLAR_CONTRACT_ID: core
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: taiki-e/install-action@just
       - uses: taiki-e/install-action@nextest
       - uses: stellar/stellar-cli@v27.0.0
diff --git a/.github/workflows/validate-registry-intake.yml b/.github/workflows/validate-registry-intake.yml
index 5856f11..870698f 100644
--- a/.github/workflows/validate-registry-intake.yml
+++ b/.github/workflows/validate-registry-intake.yml
@@ -55,7 +55,7 @@ jobs:
           echo "template=$TEMPLATE" >> "$GITHUB_OUTPUT"
 
       - name: Checkout repo (for validator scripts and form templates)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Parse intake form
         id: parse