diff --git a/.github/workflows/_deploy-core.yml b/.github/workflows/_deploy-core.yml
index 9106c78..f0a0916 100644
--- a/.github/workflows/_deploy-core.yml
+++ b/.github/workflows/_deploy-core.yml
@@ -31,16 +31,16 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Cache pip packages
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/pip
           key: pip-ansible
 
       - name: Cache Ansible collections
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.ansible
           key: ansible-galaxy-${{ hashFiles('ansible/requirements.yml') }}
diff --git a/.github/workflows/deploy-on-merge.yml b/.github/workflows/deploy-on-merge.yml
index 6d94e09..90abb37 100644
--- a/.github/workflows/deploy-on-merge.yml
+++ b/.github/workflows/deploy-on-merge.yml
@@ -23,7 +23,7 @@ jobs:
     outputs:
       hosts: ${{ steps.discover.outputs.hosts }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Read hosts from inventory
         id: discover
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e0a5242..49bd5f2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,7 +24,7 @@ jobs:
     outputs:
       hosts: ${{ steps.prepare.outputs.hosts }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build host matrix
         id: prepare
diff --git a/.github/workflows/lint-ansible.yml b/.github/workflows/lint-ansible.yml
index 8331e8d..b900cff 100644
--- a/.github/workflows/lint-ansible.yml
+++ b/.github/workflows/lint-ansible.yml
@@ -8,7 +8,7 @@ jobs:
     name: ansible-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Check for Ansible files
         id: check
diff --git a/.github/workflows/lint-docker-compose.yml b/.github/workflows/lint-docker-compose.yml
index 7ae874e..9cd24e7 100644
--- a/.github/workflows/lint-docker-compose.yml
+++ b/.github/workflows/lint-docker-compose.yml
@@ -8,7 +8,7 @@ jobs:
     name: docker compose config
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Stub missing env files referenced by Compose
         run: |
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index af906c8..a7f942d 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -22,7 +22,7 @@ jobs:
     name: Plan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-tofu
 
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: production
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-tofu
 
diff --git a/.github/workflows/validate-caddyfile.yml b/.github/workflows/validate-caddyfile.yml
index 650de91..89dd150 100644
--- a/.github/workflows/validate-caddyfile.yml
+++ b/.github/workflows/validate-caddyfile.yml
@@ -8,7 +8,7 @@ jobs:
     name: caddy validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Check for Caddyfile
         id: check
diff --git a/.github/workflows/validate-terraform.yml b/.github/workflows/validate-terraform.yml
index ac46c23..c2eadc0 100644
--- a/.github/workflows/validate-terraform.yml
+++ b/.github/workflows/validate-terraform.yml
@@ -22,7 +22,7 @@ jobs:
     name: tofu plan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-tofu