diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cf29c04..19421b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     name: Lint (black, isort, flake8, mypy, import-linter)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -44,7 +44,7 @@ jobs:
         # la crédibilité du support Python 3.9–3.14 claimed dans pyproject.toml.
         python: ${{ fromJSON(github.event_name == 'pull_request' && '["3.12"]' || '["3.9","3.10","3.11","3.12","3.13","3.14"]') }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
@@ -69,7 +69,7 @@ jobs:
     name: Build documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
@@ -113,7 +113,7 @@ jobs:
       MYSQL_PASSWORD: mysqlpw
       MYSQL_DATABASE: db2sqltest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
@@ -178,7 +178,7 @@ jobs:
       ORACLE_USER: apptest
       ORACLE_PASSWORD: apptestpw
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b2248a3..d2b893f 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,7 +18,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index b23763d..6c146d7 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -54,7 +54,7 @@ jobs:
             container: ""
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The Debian 12 container already ships with the right Python; only
       # call setup-python on bare host runners (Windows / macOS).
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ab14102..90f1aa7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,7 +57,7 @@ jobs:
       version:  ${{ steps.release.outputs.version }}
       tag:      ${{ steps.release.outputs.tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           # PAT is required so that the commit + tag pushed below re-trigger