diff --git a/.github/workflows/canva-pipeline.yml b/.github/workflows/canva-pipeline.yml
index fee017b..4c64541 100644
--- a/.github/workflows/canva-pipeline.yml
+++ b/.github/workflows/canva-pipeline.yml
@@ -25,7 +25,7 @@ jobs:
     outputs:
       should-run: ${{ steps.filter.outputs.canva }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -45,7 +45,7 @@ jobs:
     name: Fixture conversion + plan compile + dry-run apply
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node 20
         uses: actions/setup-node@v4
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 36756c9..fc694d1 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/gui-release.yml b/.github/workflows/gui-release.yml
index 73886b2..5dbecbc 100644
--- a/.github/workflows/gui-release.yml
+++ b/.github/workflows/gui-release.yml
@@ -27,7 +27,7 @@ jobs:
             artifacts: 'packages/gui/dist/*.AppImage'
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enable Corepack (pnpm)
         run: corepack enable
diff --git a/.github/workflows/gui.yml b/.github/workflows/gui.yml
index 2343939..d9ab714 100644
--- a/.github/workflows/gui.yml
+++ b/.github/workflows/gui.yml
@@ -21,7 +21,7 @@ jobs:
     # The GUI's orchestration core is pure Node/TS and tests run headless — no
     # Electron window is launched, so this lane needs no display server.
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # pnpm via Corepack — the pnpm/action-setup marketplace action isn't on this
       # repo's allowed-actions list (see pipeline-tests.yml).
@@ -61,7 +61,7 @@ jobs:
     # setup view. Separate job because it needs the Electron binary + a display.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enable Corepack (pnpm)
         run: corepack enable
diff --git a/.github/workflows/init-wizard.yml b/.github/workflows/init-wizard.yml
index 9c2116f..207a2a5 100644
--- a/.github/workflows/init-wizard.yml
+++ b/.github/workflows/init-wizard.yml
@@ -28,7 +28,7 @@ jobs:
   init-wizard:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # pnpm via Corepack — pnpm/action-setup isn't on the allowed-actions list.
       - name: Enable Corepack (pnpm)
diff --git a/.github/workflows/lighthouse-ci.yml b/.github/workflows/lighthouse-ci.yml
index 005e080..5d1c626 100644
--- a/.github/workflows/lighthouse-ci.yml
+++ b/.github/workflows/lighthouse-ci.yml
@@ -47,7 +47,7 @@ jobs:
 
       - name: Checkout
         if: steps.gate.outputs.configured == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node 20
         if: steps.gate.outputs.configured == 'true'
diff --git a/.github/workflows/pipeline-tests.yml b/.github/workflows/pipeline-tests.yml
index 9b500cb..9fcdf92 100644
--- a/.github/workflows/pipeline-tests.yml
+++ b/.github/workflows/pipeline-tests.yml
@@ -16,7 +16,7 @@ jobs:
       should-test: ${{ steps.filter.outputs.scripts || steps.filter.outputs.tests }}
       should-test-pipeline-pkg: ${{ steps.filter.outputs.pipeline-pkg }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout with submodules
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # pnpm via Corepack (bundled with Node) — the pnpm/action-setup
       # marketplace action isn't on this repo's allowed-actions list.
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 069335b..0533705 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
         uses: actions/setup-node@v4
diff --git a/.github/workflows/site-validation.yml b/.github/workflows/site-validation.yml
index c657e1c..81ae318 100644
--- a/.github/workflows/site-validation.yml
+++ b/.github/workflows/site-validation.yml
@@ -25,7 +25,7 @@ jobs:
     outputs:
       should-validate: ${{ steps.filter.outputs.site }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node 20
         uses: actions/setup-node@v4
diff --git a/.github/workflows/validate-configs.yml b/.github/workflows/validate-configs.yml
index bed14d1..468c488 100644
--- a/.github/workflows/validate-configs.yml
+++ b/.github/workflows/validate-configs.yml
@@ -18,7 +18,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: true
 
diff --git a/.github/workflows/visual-regression.yml b/.github/workflows/visual-regression.yml
index 5734727..1067862 100644
--- a/.github/workflows/visual-regression.yml
+++ b/.github/workflows/visual-regression.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Checkout
         if: steps.gate.outputs.configured == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}