diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 8f46a03..80a0db1 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -36,7 +36,7 @@ jobs:
     env:
       ABIS: arm64-v8a x86_64
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive          # MUST be recursive: coucal is nested in httrack
       - name: Set up NDK ${{ env.NDK_VERSION }}
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/xroche/httrack-android-build:latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive          # MUST be recursive: coucal is nested in httrack
       - name: Vendor libiconv
@@ -114,7 +114,7 @@ jobs:
     name: play tooling
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1658756..5e0cc6a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,7 +39,7 @@ jobs:
           - { language: java-kotlin, build-mode: none }
           - { language: c-cpp,       build-mode: manual }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
       - uses: github/codeql-action/init@v3
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index c761f3f..8502cca 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -24,7 +24,7 @@ jobs:
   build-push:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/login-action@v4
         with:
           registry: ghcr.io
diff --git a/.github/workflows/play-halt.yml b/.github/workflows/play-halt.yml
index 4bbe926..93cfee2 100644
--- a/.github/workflows/play-halt.yml
+++ b/.github/workflows/play-halt.yml
@@ -32,7 +32,7 @@ jobs:
     name: halt on Play
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
diff --git a/.github/workflows/play-promote.yml b/.github/workflows/play-promote.yml
index 9849775..ebb00c7 100644
--- a/.github/workflows/play-promote.yml
+++ b/.github/workflows/play-promote.yml
@@ -34,7 +34,7 @@ jobs:
     name: promote on Play
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
diff --git a/.github/workflows/play-publish.yml b/.github/workflows/play-publish.yml
index d20892c..791f07c 100644
--- a/.github/workflows/play-publish.yml
+++ b/.github/workflows/play-publish.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/xroche/httrack-android-build:latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive          # coucal is nested in httrack
       - name: Vendor libiconv
@@ -73,7 +73,7 @@ jobs:
       # This job holds the Play credential, so it takes the narrowest checkout that
       # still feeds whatsNewDirectory below. Without it the action uploads the AAB,
       # then dies scanning for notes that were never in this job's workspace.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           sparse-checkout: distribution/whatsnew
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/play-reviews.yml b/.github/workflows/play-reviews.yml
index eb20100..4802a16 100644
--- a/.github/workflows/play-reviews.yml
+++ b/.github/workflows/play-reviews.yml
@@ -19,7 +19,7 @@ jobs:
     name: collect reviews
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'