diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 34dc813..8258c71 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -37,7 +37,7 @@ jobs:
       # Selected before init: each CI role can reach only its own environment's state.
       TF_WORKSPACE: ${{ inputs.environment }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::132218943709:role/snacker-tracker-${{ inputs.environment }}-ci
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index 59b7b0f..6de1a77 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -25,7 +25,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v6
         with:
           version: "0.13.4"
@@ -39,7 +39,7 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: 24
@@ -71,7 +71,7 @@ jobs:
       run:
         working-directory: infra/main
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ env.DEV_CI_ROLE }}
@@ -100,7 +100,7 @@ jobs:
     outputs:
       image_uri: ${{ steps.image.outputs.image_uri }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: ${{ env.DEV_CI_ROLE }}