diff --git a/.github/workflows/build_and_publish.yml b/.github/workflows/build_and_publish.yml
index 48df1d78..222f2f42 100644
--- a/.github/workflows/build_and_publish.yml
+++ b/.github/workflows/build_and_publish.yml
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # we need the full history for gitleaks to work properly, otherwise it will just scan the latest commit which is not very useful
           fetch-depth: 0
@@ -94,7 +94,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/common-setup
         timeout-minutes: 3
       - run: just js_setup
@@ -111,7 +111,7 @@ jobs:
       packages: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/common-setup
         timeout-minutes: 1
       # login before building so previous build image can be pulled for nixpacks cache