diff --git a/.github/workflows/definition-of-done.yml b/.github/workflows/definition-of-done.yml
index 7213d61..7d7106d 100644
--- a/.github/workflows/definition-of-done.yml
+++ b/.github/workflows/definition-of-done.yml
@@ -22,7 +22,7 @@ jobs:
     name: Lint — no mocks in runtime-e2e/
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run lint
         run: |
           if [ -x scripts/lint-no-mocks-in-runtime-e2e.sh ]; then
@@ -35,7 +35,7 @@ jobs:
     name: Runtime E2E required for user-facing changes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/heartbeat-real-stack.yml b/.github/workflows/heartbeat-real-stack.yml
index f4e1694..9245d52 100644
--- a/.github/workflows/heartbeat-real-stack.yml
+++ b/.github/workflows/heartbeat-real-stack.yml
@@ -42,7 +42,7 @@ jobs:
     env:
       AXONFLOW_TELEMETRY: "off"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/host-cli-shim.yml b/.github/workflows/host-cli-shim.yml
index a519ad4..d494c0d 100644
--- a/.github/workflows/host-cli-shim.yml
+++ b/.github/workflows/host-cli-shim.yml
@@ -56,7 +56,7 @@ jobs:
     env:
       AXONFLOW_TELEMETRY: 'off'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run host-CLI shim
         run: bash tests/host-cli-shim/run.sh
diff --git a/.github/workflows/install-smoke.yml b/.github/workflows/install-smoke.yml
index cfbf1c3..993c8cc 100644
--- a/.github/workflows/install-smoke.yml
+++ b/.github/workflows/install-smoke.yml
@@ -38,7 +38,7 @@ jobs:
       AXONFLOW_TELEMETRY: "off"
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/smoke-e2e.yml b/.github/workflows/smoke-e2e.yml
index 8639dc1..616a729 100644
--- a/.github/workflows/smoke-e2e.yml
+++ b/.github/workflows/smoke-e2e.yml
@@ -31,7 +31,7 @@ jobs:
       AXONFLOW_CLIENT_SECRET: demo-secret
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cbb5309..5ea9c43 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
     env:
       AXONFLOW_TELEMETRY: "off"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check shell script syntax
         run: |
diff --git a/.github/workflows/wire-shape-contract.yml b/.github/workflows/wire-shape-contract.yml
index dcbb12d..ed0f3eb 100644
--- a/.github/workflows/wire-shape-contract.yml
+++ b/.github/workflows/wire-shape-contract.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout plugin (full history for SHA-bump guard)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -107,7 +107,7 @@ jobs:
           exit 1
 
       - name: Checkout OpenAPI specs (pinned to baseline SHA)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: getaxonflow/axonflow
           ref: ${{ steps.specs_sha.outputs.sha }}