diff --git a/.github/workflows/bindings-c.yml b/.github/workflows/bindings-c.yml
index 920c3162..be87ae08 100644
--- a/.github/workflows/bindings-c.yml
+++ b/.github/workflows/bindings-c.yml
@@ -26,7 +26,7 @@ jobs:
   smoke-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Build and install libpathrs.so.
       - uses: dtolnay/rust-toolchain@stable
       - name: build libpathrs
diff --git a/.github/workflows/bindings-go.yml b/.github/workflows/bindings-go.yml
index 8ec924a3..a78f2c39 100644
--- a/.github/workflows/bindings-go.yml
+++ b/.github/workflows/bindings-go.yml
@@ -33,7 +33,7 @@ jobs:
       checks: write # to allow the action to annotate code in the pr.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Build and install libpathrs.so.
       - uses: dtolnay/rust-toolchain@stable
       - name: build libpathrs
@@ -49,7 +49,7 @@ jobs:
   go-fix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
       # Build and install libpathrs.so.
@@ -78,7 +78,7 @@ jobs:
           - "stable"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Build and install libpathrs.so.
       - uses: dtolnay/rust-toolchain@stable
       - name: build libpathrs
diff --git a/.github/workflows/bindings-python.yml b/.github/workflows/bindings-python.yml
index 6982b0ff..716d10af 100644
--- a/.github/workflows/bindings-python.yml
+++ b/.github/workflows/bindings-python.yml
@@ -29,7 +29,7 @@ jobs:
   ruff:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/ruff-action@v3
         with:
           args: "--version"
@@ -43,7 +43,7 @@ jobs:
       checks: write # allow the action to annotate code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Set up python venv.
       - uses: actions/setup-python@v6
       - name: install mypy
@@ -63,7 +63,7 @@ jobs:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.x"]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Build and install libpathrs.so.
       - uses: dtolnay/rust-toolchain@stable
       - name: build libpathrs
@@ -110,7 +110,7 @@ jobs:
       - build-pyproject
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Build and install libpathrs.so.
       - uses: dtolnay/rust-toolchain@stable
       - name: build libpathrs
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index ef0424a7..7fee92a9 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -66,7 +66,7 @@ jobs:
       }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: install package
         run: |-
           sudo apt-get update -y
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     name: build ci docker image
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: setup docker buildx
         uses: docker/setup-buildx-action@v4
       - name: build and cache ci image
@@ -161,7 +161,7 @@ jobs:
       run e2e-tests
       (${{ matrix.lang }}, ${{ matrix.run-as }})
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pull the image from the cache by triggering a "new build".
       - name: setup docker buildx
         uses: docker/setup-buildx-action@v4
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index e42c4a33..4fd03333 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -31,7 +31,7 @@ jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: pip install codespell==v2.3.0
       - run: codespell -L crate
 
@@ -39,7 +39,7 @@ jobs:
     name: cargo check (stable)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: taiki-e/install-action@cargo-hack
       - name: cargo check
@@ -51,7 +51,7 @@ jobs:
     name: cargo check (msrv)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: *RUST_MSRV
@@ -84,7 +84,7 @@ jobs:
     name: cargo check (${{ matrix.target }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           # TODO: Should we use MSRV for this?
@@ -103,7 +103,7 @@ jobs:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # We need to use nightly Rust to check the formatting.
       - uses: dtolnay/rust-toolchain@nightly
         with:
@@ -114,7 +114,7 @@ jobs:
     name: clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pin the Rust version to avoid Rust updates breaking our clippy lints.
       - uses: dtolnay/rust-toolchain@1.88
         with:
@@ -129,7 +129,7 @@ jobs:
     name: make lint (no cargo-hack)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt,clippy
@@ -141,7 +141,7 @@ jobs:
   validate-cbindgen:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: install cbindgen
         run: cargo install --force --locked cbindgen@${{ env.CBINDGEN_VERSION }}
@@ -160,7 +160,7 @@ jobs:
           - stable
           - nightly
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.rust-version }}
@@ -171,13 +171,13 @@ jobs:
   validate-keyring:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: make validate-keyring
 
   validate-dist-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: make dist-release
       - name: check release artefacts
@@ -197,7 +197,7 @@ jobs:
           - stable
           - nightly
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.rust-version }}
@@ -210,7 +210,7 @@ jobs:
     name: cargo doc
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo doc --document-private-items --workspace --all-features
       - name: upload docs
@@ -234,7 +234,7 @@ jobs:
         _test_race
         ${{ matrix.run-as == 'root' && '_test_as_root _test_can_mknod' || '' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Nightly rust is required for llvm-cov --doc.
       - uses: dtolnay/rust-toolchain@nightly
         with:
@@ -261,7 +261,7 @@ jobs:
     env:
       CARGO_NIGHTLY: cargo
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Nightly rust is required for llvm-cov --doc.
       - uses: dtolnay/rust-toolchain@nightly
         with:
@@ -285,7 +285,7 @@ jobs:
     outputs:
       tests: ${{ steps.test-partitions.outputs.data }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: compute test partitions
         id: test-partitions
         run: |-
@@ -332,7 +332,7 @@ jobs:
           )
       }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Nightly rust is required for llvm-cov --doc.
       - uses: dtolnay/rust-toolchain@nightly
         with:
@@ -390,7 +390,7 @@ jobs:
     runs-on: ubuntu-latest
     name: build ci docker image
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: setup docker buildx
         uses: docker/setup-buildx-action@v4
       - name: build and cache ci image
@@ -428,7 +428,7 @@ jobs:
       cargo nextest
       (${{ fromJSON(matrix.tests).name }}, ${{ matrix.run-as }})
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Nightly rust is required for llvm-cov --doc.
       - uses: dtolnay/rust-toolchain@nightly
         with:
@@ -493,7 +493,7 @@ jobs:
     name: cargo test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: cargo test
         run: cargo test --features capi
@@ -506,7 +506,7 @@ jobs:
     name: compute coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Nightly rust is required for llvm-cov --doc.
       - uses: dtolnay/rust-toolchain@nightly
         with:
@@ -567,7 +567,7 @@ jobs:
     name: smoke-test examples
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo build --examples
       - run: make -C examples smoke-test-rust
@@ -583,7 +583,7 @@ jobs:
     name: check ${{ matrix.libtype }} size
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: make release
       - name: compute ${{ matrix.libtype }} file name
@@ -667,7 +667,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo publish
         env: