diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index c452506..3a00119 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -26,10 +26,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           # No cache: pip here. It keys off a hashed requirements.txt or
           # pyproject.toml, and this repository ships neither, so it only ever
@@ -88,7 +88,7 @@ jobs:
       # bashcov with simplecov-cobertura generates coverage/coverage.xml
       COVERAGE_REPORT: coverage/coverage.xml
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2 # fetch-depth of 2 enables diff coverage
       - name: Install Git ${{ matrix.git-version }}
diff --git a/.github/workflows/changelog-autoupdate.yml b/.github/workflows/changelog-autoupdate.yml
index 36cea09..3244d1a 100644
--- a/.github/workflows/changelog-autoupdate.yml
+++ b/.github/workflows/changelog-autoupdate.yml
@@ -17,7 +17,7 @@ jobs:
   changelog-autoupdate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Full history needed for git cliff
       - name: Install git-cliff
@@ -27,7 +27,7 @@ jobs:
       - name: Update Unreleased section
         run: scripts/update-unreleased.sh
       - name: Format CHANGELOG.md
-        uses: DavidAnson/markdownlint-cli2-action@v23
+        uses: DavidAnson/markdownlint-cli2-action@v24
         with:
           config: .markdownlint.yml
           globs: |
diff --git a/.github/workflows/delete-bot-branches-for-closed-prs.yml b/.github/workflows/delete-bot-branches-for-closed-prs.yml
index d39a610..9254980 100644
--- a/.github/workflows/delete-bot-branches-for-closed-prs.yml
+++ b/.github/workflows/delete-bot-branches-for-closed-prs.yml
@@ -20,7 +20,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.merged == false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: detect bot author
         id: bot-author-check
         uses: ./.github/actions/detect-bot-author
diff --git a/.github/workflows/greet-new-contributors.yml b/.github/workflows/greet-new-contributors.yml
index bf51a77..f448eb8 100644
--- a/.github/workflows/greet-new-contributors.yml
+++ b/.github/workflows/greet-new-contributors.yml
@@ -14,7 +14,7 @@ jobs:
   greeting:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: detect bot author
         id: bot-author-check
         uses: ./.github/actions/detect-bot-author
diff --git a/.github/workflows/lint-github-actions.yml b/.github/workflows/lint-github-actions.yml
index 07a9dd1..4cec0ec 100644
--- a/.github/workflows/lint-github-actions.yml
+++ b/.github/workflows/lint-github-actions.yml
@@ -10,7 +10,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check workflow files
         uses: docker://rhysd/actionlint:v1.7.12
         with:
diff --git a/.github/workflows/pre-commit-autoupdate.yml b/.github/workflows/pre-commit-autoupdate.yml
index faca7bc..5d483ae 100644
--- a/.github/workflows/pre-commit-autoupdate.yml
+++ b/.github/workflows/pre-commit-autoupdate.yml
@@ -20,10 +20,10 @@ jobs:
       BRANCH_NAME: chore/pre-commit-autoupdate
       PRECOMMIT_CONFIG_FILE: .pre-commit-config.yaml
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           # No cache: pip here. It keys off a hashed requirements.txt or
           # pyproject.toml, and this repository ships neither, so it only ever
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 4f7d209..7dc932c 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -22,7 +22,7 @@ jobs:
   release-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
           echo "branch=release/$tag" >> "$GITHUB_OUTPUT"
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           # No cache: pip here. It keys off a hashed requirements.txt or
           # pyproject.toml, and this repository ships neither, so it only ever
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index ab9eae7..f5104a9 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -33,7 +33,7 @@ jobs:
       # parser can be used. A tag push already lands on the tag; a manual
       # dispatch lands on the default branch. The explicit checkout below moves
       # to the requested tag in both cases.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index 564a878..c9302f8 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -32,7 +32,7 @@ jobs:
       # Checked out before the branch name is parsed so that the shared,
       # unit-tested parser can be used. The ref is the merge commit, never the
       # attacker-influenced branch name.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.merge_commit_sha }}