diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index ddf2a7dc..0562241c 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -31,7 +31,7 @@ jobs:
     name: typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd7bdb50..b225af40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
       - uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: &nix-install-with
           extra-conf: |
@@ -46,7 +46,7 @@ jobs:
       matrix: ${{ fromJson(needs.configure.outputs.matrix) }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: *nix-install-with
diff --git a/.github/workflows/deploy-api.yaml b/.github/workflows/deploy-api.yaml
index 2c29268b..b44e474a 100644
--- a/.github/workflows/deploy-api.yaml
+++ b/.github/workflows/deploy-api.yaml
@@ -55,7 +55,7 @@ jobs:
       # the derivation hash matches across steps.
       STACKPANEL_ROOT_ABSOLUTE: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: DeterminateSystems/nix-installer-action@main
         with:
diff --git a/.github/workflows/deploy-docs.yaml b/.github/workflows/deploy-docs.yaml
index 15309f80..ff860ee9 100644
--- a/.github/workflows/deploy-docs.yaml
+++ b/.github/workflows/deploy-docs.yaml
@@ -70,7 +70,7 @@ jobs:
       name: docs-${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -127,7 +127,7 @@ jobs:
       contents: read
       pull-requests: write # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/deploy-nixos.yml b/.github/workflows/deploy-nixos.yml
index c9a35438..c736029c 100644
--- a/.github/workflows/deploy-nixos.yml
+++ b/.github/workflows/deploy-nixos.yml
@@ -29,7 +29,7 @@ jobs:
     outputs:
       store-path: ${{ steps.build.outputs.store-path }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -64,7 +64,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/deploy-web.yaml b/.github/workflows/deploy-web.yaml
index 1568c391..e98e5ada 100644
--- a/.github/workflows/deploy-web.yaml
+++ b/.github/workflows/deploy-web.yaml
@@ -72,7 +72,7 @@ jobs:
       name: ${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -157,7 +157,7 @@ jobs:
       contents: read
       pull-requests: write # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/flake-checker.yml b/.github/workflows/flake-checker.yml
index e692a2d1..420733a6 100644
--- a/.github/workflows/flake-checker.yml
+++ b/.github/workflows/flake-checker.yml
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: DeterminateSystems/determinate-nix-action@v3
       - uses: DeterminateSystems/update-flake-lock@main
         with:
diff --git a/.github/workflows/flakehub-publish-rolling.yml b/.github/workflows/flakehub-publish-rolling.yml
index 8e9c67de..f4beccd9 100644
--- a/.github/workflows/flakehub-publish-rolling.yml
+++ b/.github/workflows/flakehub-publish-rolling.yml
@@ -10,7 +10,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
         with:
           persist-credentials: false
       - uses: "DeterminateSystems/determinate-nix-action@v3"
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index b8f0a8bc..2bf375e7 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -21,7 +21,7 @@ jobs:
       issues: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/secrets-codegen-check.yml b/.github/workflows/secrets-codegen-check.yml
index 95661581..0b1c866d 100644
--- a/.github/workflows/secrets-codegen-check.yml
+++ b/.github/workflows/secrets-codegen-check.yml
@@ -52,7 +52,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/test-fixtures.yml b/.github/workflows/test-fixtures.yml
index f2631957..8c0ccbaf 100644
--- a/.github/workflows/test-fixtures.yml
+++ b/.github/workflows/test-fixtures.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       fixtures: ${{ steps.list.outputs.fixtures }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: List fixtures
         id: list
         run: |
@@ -48,7 +48,7 @@ jobs:
           - aarch64-darwin
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main