diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41fcab9..fd76dde 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Run actionlint on changed workflow files
@@ -110,7 +110,7 @@ jobs:
       openapi: ${{ steps.f.outputs.openapi }}
       tauri:   ${{ steps.f.outputs.tauri }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dorny/paths-filter@v3
       id: f
       with:
@@ -160,7 +160,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
       with:
         components: clippy, rustfmt
@@ -208,7 +208,7 @@ jobs:
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.web == 'true'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: pnpm/action-setup@v4
       with:
         version: 9.15.0
@@ -232,7 +232,7 @@ jobs:
     # generate the spec from the freshly-built Cargo bin and diff
     # against the committed `schema.ts` — non-zero diff fails the job.
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
     - uses: Swatinem/rust-cache@v2
       continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
     needs: [should-run, changed, web]
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.web == 'true'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: pnpm/action-setup@v4
       with:
         version: 9.15.0
@@ -304,7 +304,7 @@ jobs:
     if: needs.should-run.outputs.run == 'true' && needs.changed.outputs.tray == 'true'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: pnpm/action-setup@v4
       with:
         version: 9.15.0
@@ -326,7 +326,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
     - uses: Swatinem/rust-cache@v2
       continue-on-error: true
diff --git a/.github/workflows/invariant-sentry.yml b/.github/workflows/invariant-sentry.yml
index f9bbddf..cfb5082 100644
--- a/.github/workflows/invariant-sentry.yml
+++ b/.github/workflows/invariant-sentry.yml
@@ -41,7 +41,7 @@ jobs:
     name: Check invariants
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
         # Default ref (HEAD of triggering branch) is fine — we use
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index f61e125..7f63249 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -92,7 +92,7 @@ jobs:
       tray:     ${{ steps.decide.outputs.tray }}
       platform: ${{ steps.decide.outputs.platform }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     # Path detection — only runs on push events. dorny/paths-filter
     # on push compares against the parent commit, which is what we
     # want (incremental detection per commit).
@@ -197,7 +197,7 @@ jobs:
         fi
 
     - name: Checkout next
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         ref: next
         fetch-depth: 0
@@ -270,7 +270,7 @@ jobs:
         fi
 
     - name: Checkout next
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         ref: next
         fetch-depth: 0
@@ -327,7 +327,7 @@ jobs:
     environment: production-release
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0
         token: ${{ secrets.RELEASE_PROMOTE_PAT }}
@@ -391,7 +391,7 @@ jobs:
     environment: production-release
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         fetch-depth: 0
         token: ${{ secrets.RELEASE_PROMOTE_PAT }}
diff --git a/.github/workflows/release-images.yml b/.github/workflows/release-images.yml
index c8538ea..b0327da 100644
--- a/.github/workflows/release-images.yml
+++ b/.github/workflows/release-images.yml
@@ -47,7 +47,7 @@ jobs:
     outputs:
       channel: ${{ steps.validate.outputs.channel }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Validate tag against branch invariants
@@ -150,7 +150,7 @@ jobs:
       )
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - uses: docker/setup-buildx-action@v3
 
@@ -244,7 +244,7 @@ jobs:
         - { image: prometheus,     context: infra/prometheus }
         - { image: db-init,        context: infra/init }
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: docker/setup-buildx-action@v3
     - name: Login to private registry
       uses: docker/login-action@v3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8dfa781..a39737b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
       channel: ${{ steps.validate.outputs.channel }}
       bare_version: ${{ steps.validate.outputs.bare_version }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Validate tag against branch invariants
@@ -112,7 +112,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - uses: dtolnay/rust-toolchain@1.88.0
     # `continue-on-error: true` so a transient Actions cache-service
     # flake in the Post-Run save step (which has bitten the Windows
@@ -231,7 +231,7 @@ jobs:
     needs: [validate-tag, client-binaries]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Download Tauri client artifacts
       uses: actions/download-artifact@v4
@@ -498,7 +498,7 @@ jobs:
         # auto-alpha). That's the desired behaviour: a manifest
         # commit on `next` shouldn't kick off a fresh pre-release
         # cycle, it's just bookkeeping.
-        # Deshallowing: actions/checkout@v4 defaults to depth=1, so
+        # Deshallowing: actions/checkout@v7 defaults to depth=1, so
         # the local repo has only the tag's commit. `git merge` then
         # refuses with "refusing to merge unrelated histories" because
         # it can't find the common ancestor between main and next
@@ -568,7 +568,7 @@ jobs:
     # available locally. promote.yml + release-promote.mjs annotate
     # the tag with a `Roadmap-Item: <slug>` line when the operator
     # passes `roadmap_item_slug` on workflow_dispatch.
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Resolve roadmap item slug
@@ -631,7 +631,7 @@ jobs:
     needs: [validate-tag, roadmap-emit-event]
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Resolve roadmap item slug