diff --git a/.github/workflows/binaries.yml b/.github/workflows/binaries.yml
index 4bc0cb3b..ecc5c1c8 100644
--- a/.github/workflows/binaries.yml
+++ b/.github/workflows/binaries.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v6
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8acce334..0be3e43b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,7 +12,7 @@ jobs:
         with:
           go-version: '~1.24'
       - name: Clone the code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install linter
         uses: golangci/golangci-lint-action@v9
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1f9fcb6f..73386bbe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Set up golang
diff --git a/.github/workflows/test-pki.yml b/.github/workflows/test-pki.yml
index 8245958a..44f5009d 100644
--- a/.github/workflows/test-pki.yml
+++ b/.github/workflows/test-pki.yml
@@ -12,7 +12,7 @@ jobs:
         with:
           go-version: '~1.24'
       - name: Clone the code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Setup test deps
         run: sudo make install-test-pki-deps
       - name: Run tests
diff --git a/.github/workflows/tuf.yml b/.github/workflows/tuf.yml
index 7c481eb9..c2cdf330 100644
--- a/.github/workflows/tuf.yml
+++ b/.github/workflows/tuf.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: tuf-metadata
       - name: Setup signing key