diff --git a/.github/workflows/architecture-guardian.yml b/.github/workflows/architecture-guardian.yml
index c482cb119..077a88ec2 100644
--- a/.github/workflows/architecture-guardian.yml
+++ b/.github/workflows/architecture-guardian.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/cga-attestation.yml b/.github/workflows/cga-attestation.yml
index 4c1fdf239..90aa35efc 100644
--- a/.github/workflows/cga-attestation.yml
+++ b/.github/workflows/cga-attestation.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # full history needed for git_stats during indexing
 
@@ -146,7 +146,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/dogfood.yml b/.github/workflows/dogfood.yml
index 904f7d618..40b6ef3f8 100644
--- a/.github/workflows/dogfood.yml
+++ b/.github/workflows/dogfood.yml
@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 50  # enough for pr-prep churn analysis
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3a006709d..941b846ff 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # W1055: pin the checkout to the resolved tag commit, NOT the
           # workflow's default ref. For a delayed ``release: published`` or a
@@ -530,7 +530,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # W1055: smoke-test the SAME tagged commit's verification scripts,
           # not trunk's — keeps the post-publish check bound to the release.
diff --git a/.github/workflows/roam-ci.yml b/.github/workflows/roam-ci.yml
index d19e00377..70c6e6166 100644
--- a/.github/workflows/roam-ci.yml
+++ b/.github/workflows/roam-ci.yml
@@ -53,7 +53,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # full history needed for git-stats and pr-risk tests
 
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -131,7 +131,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # for the test that uses git ls-files
 
@@ -180,7 +180,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -235,7 +235,7 @@ jobs:
     timeout-minutes: 20
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # full history required for pr-risk and git analysis
 
diff --git a/.github/workflows/roam.yml b/.github/workflows/roam.yml
index 17098fe9c..6b35fd12c 100644
--- a/.github/workflows/roam.yml
+++ b/.github/workflows/roam.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history needed for pr-risk and git analysis