diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d6d396c..94fd146 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
     # authenticated GHCR access; GitHub-hosted runners have ambient auth, self-hosted ARM do not.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Validate docker-compose.yml
         env:
@@ -42,7 +42,7 @@ jobs:
     name: Kustomize Validate
     runs-on: [self-hosted, linux, arm64]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up kubectl (includes kustomize)
         uses: azure/setup-kubectl@v5
diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index 41657e9..2578d3b 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -45,7 +45,7 @@ jobs:
           exit 1
 
       - name: Checkout deploy config
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup SSH
         run: |
diff --git a/.github/workflows/license-integrity.yml b/.github/workflows/license-integrity.yml
index 8f54438..8c7d7f1 100644
--- a/.github/workflows/license-integrity.yml
+++ b/.github/workflows/license-integrity.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Compute LICENSE ref hash
         id: ref-hash
diff --git a/.github/workflows/namespace-cleanup.yml b/.github/workflows/namespace-cleanup.yml
index acb757f..c17515e 100644
--- a/.github/workflows/namespace-cleanup.yml
+++ b/.github/workflows/namespace-cleanup.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run namespace cleanup
         env:
diff --git a/.github/workflows/playground-monitor-deploy.yml b/.github/workflows/playground-monitor-deploy.yml
index 013fd1a..9b6cf89 100644
--- a/.github/workflows/playground-monitor-deploy.yml
+++ b/.github/workflows/playground-monitor-deploy.yml
@@ -20,7 +20,7 @@ jobs:
     env:
       PLAYGROUND_IP: ${{ github.event.inputs.playground_ip || secrets.PLAYGROUND_IP }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up SSH key
         run: |
diff --git a/.github/workflows/playground-provision.yml b/.github/workflows/playground-provision.yml
index 84a8ff2..95a657e 100644
--- a/.github/workflows/playground-provision.yml
+++ b/.github/workflows/playground-provision.yml
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install hcloud CLI
         run: |
@@ -188,7 +188,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup SSH key
         run: |
diff --git a/.github/workflows/playground-proxy-ci.yml b/.github/workflows/playground-proxy-ci.yml
index 06925f4..5d65fee 100644
--- a/.github/workflows/playground-proxy-ci.yml
+++ b/.github/workflows/playground-proxy-ci.yml
@@ -21,7 +21,7 @@ jobs:
       run:
         working-directory: docker/playground/proxy
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
diff --git a/.github/workflows/playground-proxy-deploy.yml b/.github/workflows/playground-proxy-deploy.yml
index 13ead72..50119bb 100644
--- a/.github/workflows/playground-proxy-deploy.yml
+++ b/.github/workflows/playground-proxy-deploy.yml
@@ -30,7 +30,7 @@ jobs:
     name: Deploy sandbox proxy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up SSH
         run: |