diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 389695e..2ac4dfc 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -20,7 +20,7 @@ jobs:
   checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Verify generated images match templates
         run: |
           docker run --rm --user "$(id -u):$(id -g)" -v "$PWD:/app" fireworkweb/fwd:v1.0 fwd template
@@ -43,7 +43,7 @@ jobs:
       NGINX: ${{ matrix.version }}${{ matrix.distro }}-nginx${{ matrix.type }}
       NODE: ${{ matrix.version }}-node
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # The docker driver lets derived images use the base built in this job.
       # Tests are native amd64; QEMU is only needed for multi-arch publishing.
@@ -101,7 +101,7 @@ jobs:
     env:
       TAG: ${{ matrix.version }}${{ matrix.distro }}${{ matrix.type }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
@@ -134,7 +134,7 @@ jobs:
     env:
       TAG: ${{ matrix.version }}${{ matrix.distro }}-nginx${{ matrix.type }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
@@ -162,7 +162,7 @@ jobs:
     env:
       TAG: ${{ matrix.version }}-node
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
diff --git a/.github/workflows/docker-description.yml b/.github/workflows/docker-description.yml
index 0b1b8ab..62ad7d0 100644
--- a/.github/workflows/docker-description.yml
+++ b/.github/workflows/docker-description.yml
@@ -15,7 +15,7 @@ jobs:
   docker-description:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
 
       - name: Sync Docker Hub Description
         uses: peter-evans/dockerhub-description@v5.0.0