diff --git a/.github/actions/bench/action.yml b/.github/actions/bench/action.yml
index 2fae14d0dd..fe7215b25f 100644
--- a/.github/actions/bench/action.yml
+++ b/.github/actions/bench/action.yml
@@ -93,7 +93,7 @@ runs:
       run: |
         ./scripts/check-namespace
     - name: Store benchmark result
-      uses: benchmark-action/github-action-benchmark@d48d326b4ca9ba73ca0cd0d59f108f9e02a381c7 # v1.20.4
+      uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
       with:
         name: ${{ inputs.name }}
         tool: "customSmallerIsBetter"
diff --git a/.github/actions/cbmc/action.yml b/.github/actions/cbmc/action.yml
index f5915dc683..de0cd99539 100644
--- a/.github/actions/cbmc/action.yml
+++ b/.github/actions/cbmc/action.yml
@@ -26,7 +26,7 @@ inputs:
 runs:
   using: composite
   steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-shell
         with:
           nix-shell: ${{ inputs.nix-shell }}
diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
index 03cdc4489d..4315382538 100644
--- a/.github/actions/setup-nix/action.yml
+++ b/.github/actions/setup-nix/action.yml
@@ -104,7 +104,7 @@ runs:
         fi
         nix config show
         echo "::endgroup::"
-    - uses: nix-community/cache-nix-action@dab0514428ae3988852b7787a6d86a6fc571cc9d #v6.0.0
+    - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
       id: cache
       if: ${{ env.NIX_CACHE_ENABLED != 1 && inputs.cache == 'true' }}
       continue-on-error: true
diff --git a/.github/workflows/baremetal.yml b/.github/workflows/baremetal.yml
index 2c83c7b7a2..7269f44dc9 100644
--- a/.github/workflows/baremetal.yml
+++ b/.github/workflows/baremetal.yml
@@ -29,7 +29,7 @@ jobs:
            opt: no_opt
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: baremetal build + test
         uses: ./.github/actions/functest
         env:
@@ -72,7 +72,7 @@ jobs:
           - x4_v8a_v84a_scalar
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: baremetal build + test
         uses: ./.github/actions/functest
         env:
diff --git a/.github/workflows/base.yml b/.github/workflows/base.yml
index 75ca6df91a..92cf9b60a4 100644
--- a/.github/workflows/base.yml
+++ b/.github/workflows/base.yml
@@ -17,7 +17,7 @@ jobs:
     name: Linting
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/lint
         with:
           gh_token: ${{ secrets.GITHUB_TOKEN }}
@@ -46,7 +46,7 @@ jobs:
     name: Quickcheck (${{ matrix.target.name }})
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: make quickcheck
         run: |
           OPT=0 make quickcheck
@@ -77,7 +77,7 @@ jobs:
     name: Quickcheck ACVP (${{ matrix.target.name }}, ${{ matrix.acvp-version }})
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Run ACVP test
         run: |
           ./scripts/tests acvp --version ${{ matrix.acvp-version }}
@@ -105,7 +105,7 @@ jobs:
     name: Quickcheck bench (${{ matrix.target.name }})
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: "tests bench (cycles: NO)"
         run: |
           ./scripts/tests bench -c NO
@@ -148,7 +148,7 @@ jobs:
     name: Quickcheck C90 (${{ matrix.target.name }})
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: make quickcheck
         run: |
           OPT=0 CFLAGS=-std=c90 make quickcheck
@@ -172,7 +172,7 @@ jobs:
     name: Quickcheck ${{ matrix.system }}
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       - name: Build test
         shell: powershell
@@ -189,7 +189,7 @@ jobs:
     name: Quickcheck (Mingw-w64 ${{ matrix.mingw-version }})
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install MinGW-w64
         run: choco install mingw --version=${{ matrix.mingw-version }} -y
         shell: cmd
@@ -211,7 +211,7 @@ jobs:
         system: [macos-latest, macos-15-intel, ubuntu-latest, ubuntu-24.04-arm]
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: make lib
         run: |
           make lib
@@ -222,7 +222,7 @@ jobs:
         system: [macos-latest, macos-15-intel, ubuntu-latest, ubuntu-24.04-arm]
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: basic
         run: |
           CFLAGS="-O0" make run -C examples/basic
@@ -273,7 +273,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     name: AArch64 dev backend (${{ matrix.backend.name }}, ${{ matrix.simplify.name }})
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Reinstate and test backend
         uses: ./.github/actions/setup-shell
         with:
@@ -287,7 +287,7 @@ jobs:
     name: x86_64 Intel syntax
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Generate with Intel syntax and test
         uses: ./.github/actions/setup-shell
         with:
@@ -311,7 +311,7 @@ jobs:
     name: scan-build (${{ matrix.target.name }})
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-apt
         with:
           packages: clang-tools clang
@@ -323,5 +323,5 @@ jobs:
   symlink-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - uses: donatj/symlink-check-action@b3c737d0fd4e52752f0b8c71a03f3f775fa015cb
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index b2bb6aa566..16f1da7f99 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -82,7 +82,7 @@ jobs:
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork && (github.event.label.name == 'benchmark' || github.ref == 'refs/heads/main')
     runs-on: self-hosted-${{ matrix.target.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/bench
         with:
           name: ${{ matrix.target.name }}
diff --git a/.github/workflows/bench_ec2_reusable.yml b/.github/workflows/bench_ec2_reusable.yml
index 21e760e8ce..203d584392 100644
--- a/.github/workflows/bench_ec2_reusable.yml
+++ b/.github/workflows/bench_ec2_reusable.yml
@@ -95,7 +95,7 @@ jobs:
       label: ${{ steps.start-ec2-runner.outputs.label }}
       ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine AMI ID
         id: det_ami_id
         run: |
@@ -109,7 +109,7 @@ jobs:
           echo "Using AMI ID: $AMI_ID"
           echo "AMI_ID=$AMI_ID" >> "$GITHUB_OUTPUT"
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ inputs.aws_region }}
@@ -136,7 +136,7 @@ jobs:
     needs: start-ec2-runner # required to start the main job when the runner is ready
     if: ${{ inputs.compiler == '' }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/bench
         if: ${{ inputs.opt == 'all' || inputs.opt == 'opt' }}
         with:
@@ -173,7 +173,7 @@ jobs:
     needs: start-ec2-runner # required to start the main job when the runner is ready
     if: ${{ inputs.compiler != '' }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-apt
         with:
           packages: ${{ inputs.additional_packages }}
@@ -226,7 +226,7 @@ jobs:
     if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ inputs.aws_region }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c839502e5..d9f9b322b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
     name: Functional tests (${{ matrix.target.name }})
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: build + test (no-opt)
         uses: ./.github/actions/multi-functest
         # no-opt exercises only the C fallback, so RVV VLEN is irrelevant; run once for riscv64
@@ -166,7 +166,7 @@ jobs:
     name: Functional tests (ppc64le/POWER10, native)
     runs-on: pqcp-ppc64
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: build + test
         uses: ./.github/actions/multi-functest
         with:
@@ -187,7 +187,7 @@ jobs:
         backend: [x1_scalar, x1_v84a, x2_v84a, x4_v8a_scalar, x4_v8a_v84a_scalar]
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: build + test
         uses: ./.github/actions/multi-functest
         with:
@@ -305,7 +305,7 @@ jobs:
            examples: False
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: native build+functest (default)
         if: ${{ matrix.compiler.darwin || matrix.target.runner != 'macos-latest' }}
         uses: ./.github/actions/multi-functest
@@ -409,7 +409,7 @@ jobs:
           - external: true
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Stack analysis
         uses: ./.github/actions/multi-functest
         with:
@@ -443,7 +443,7 @@ jobs:
           - external: true
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Unit tests under valgrind
         uses: ./.github/actions/functest
         with:
@@ -490,7 +490,7 @@ jobs:
              }}
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: "Config Variations"
         uses: ./.github/actions/config-variations
         with:
@@ -510,7 +510,7 @@ jobs:
     # On AArch64 -fcf-protection is not supported anyway
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Test control-flow protections
         uses: ./.github/actions/multi-functest
         with:
@@ -542,7 +542,7 @@ jobs:
     name: Check API consistency
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: make quickcheck
         run: |
           OPT=0 CFLAGS="-Imlkem -DMLK_CHECK_APIS -Wno-redundant-decls" make quickcheck
@@ -731,7 +731,7 @@ jobs:
     runs-on: ${{ matrix.target.system }}
     name: Check autogenerated files
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-shell
         with:
           nix-shell: ${{ matrix.target.nix_shell }}
@@ -763,7 +763,7 @@ jobs:
     runs-on: ${{ matrix.target.system }}
     name: Check object code in HOL-Light proofs
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-shell
         with:
           nix-shell: ${{ matrix.target.nix_shell }}
diff --git a/.github/workflows/ci_ec2_container.yml b/.github/workflows/ci_ec2_container.yml
index 3142e3bb4a..22d4b6298b 100644
--- a/.github/workflows/ci_ec2_container.yml
+++ b/.github/workflows/ci_ec2_container.yml
@@ -79,7 +79,7 @@ jobs:
       label: ${{ steps.remember-runner.outputs.label }}
       ec2-instance-id: ${{ steps.remember-runner.outputs.ec2-instance-id }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine AMI ID
         id: det_ami_id
         run: |
@@ -93,7 +93,7 @@ jobs:
           echo "Using AMI ID: $AMI_ID"
           echo "AMI_ID=$AMI_ID" >> "$GITHUB_OUTPUT"
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -203,7 +203,7 @@ jobs:
     if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
diff --git a/.github/workflows/ci_ec2_reusable.yml b/.github/workflows/ci_ec2_reusable.yml
index fbaceb9cec..191f393638 100644
--- a/.github/workflows/ci_ec2_reusable.yml
+++ b/.github/workflows/ci_ec2_reusable.yml
@@ -89,7 +89,7 @@ jobs:
       label: ${{ steps.remember-runner.outputs.label }}
       ec2-instance-id: ${{ steps.remember-runner.outputs.ec2-instance-id }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine AMI ID
         id: det_ami_id
         run: |
@@ -103,7 +103,7 @@ jobs:
           echo "Using AMI ID: $AMI_ID"
           echo "AMI_ID=$AMI_ID" >> "$GITHUB_OUTPUT"
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -162,7 +162,7 @@ jobs:
     needs: start-ec2-runner
     runs-on: ${{ needs.start-ec2-runner.outputs.label }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Linting
         if: ${{ inputs.lint }}
         uses: ./.github/actions/lint
@@ -228,7 +228,7 @@ jobs:
     if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
diff --git a/.github/workflows/ct-tests.yml b/.github/workflows/ct-tests.yml
index 36ac58c1ba..543611d506 100644
--- a/.github/workflows/ct-tests.yml
+++ b/.github/workflows/ct-tests.yml
@@ -31,7 +31,7 @@ jobs:
           - valgrind-varlat_gcc16
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup nix
         uses: ./.github/actions/setup-shell
         with:
diff --git a/.github/workflows/hol_light.yml b/.github/workflows/hol_light.yml
index c381c287d0..9455b8ba81 100644
--- a/.github/workflows/hol_light.yml
+++ b/.github/workflows/hol_light.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-shell
@@ -62,7 +62,7 @@ jobs:
     needs: [ hol_light_bytecode ]
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-shell
@@ -113,7 +113,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Get changed files
@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-shell
@@ -171,7 +171,7 @@ jobs:
     needs: [ hol_light_bytecode_x86_64 ]
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-shell
@@ -234,7 +234,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Get changed files
diff --git a/.github/workflows/integration-awslc.yml b/.github/workflows/integration-awslc.yml
index ca82a63036..f700586dfd 100644
--- a/.github/workflows/integration-awslc.yml
+++ b/.github/workflows/integration-awslc.yml
@@ -33,7 +33,7 @@ jobs:
     name: AWS-LC FIPS test (${{ matrix.system }}, FIPS=${{ matrix.fips }})
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-os
         with:
           packages: ${{ env.DEPENDENCIES }}
@@ -93,7 +93,7 @@ jobs:
     name: Posix test (${{ matrix.test.name }}, ${{ matrix.system }})
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-os
         with:
           packages: ${{ env.DEPENDENCIES }}
@@ -138,7 +138,7 @@ jobs:
     name: Prefix test (${{ matrix.test.name }}, ${{ matrix.system }})
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-os
         with:
           packages: ${{ env.DEPENDENCIES }}
diff --git a/.github/workflows/integration-liboqs.yml b/.github/workflows/integration-liboqs.yml
index e4fbcdcce9..726af8db2d 100644
--- a/.github/workflows/integration-liboqs.yml
+++ b/.github/workflows/integration-liboqs.yml
@@ -34,7 +34,7 @@ jobs:
     name: Build (${{ matrix.name }}, ${{ matrix.system }})
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-os
         with:
           packages: 'cmake python3-jinja2 python3-tabulate python3-git python3-pytest valgrind'
diff --git a/.github/workflows/integration-pavona.yml b/.github/workflows/integration-pavona.yml
index f6e06f5714..feb707c850 100644
--- a/.github/workflows/integration-pavona.yml
+++ b/.github/workflows/integration-pavona.yml
@@ -25,10 +25,10 @@ jobs:
       label: ${{ steps.start-ec2-runner.outputs.label }}
       ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -55,7 +55,7 @@ jobs:
     if: ${{ github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork }}
     runs-on: ${{ needs.start-ec2-runner.outputs.label }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-pavona
         with:
           pavona-repository: https://github.com/pavona/pavona
@@ -107,7 +107,7 @@ jobs:
     if: ${{ always() && github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork }} # required to stop the runner even if errors occur
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ env.AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
diff --git a/.github/workflows/legacy-compilers.yml b/.github/workflows/legacy-compilers.yml
index b8b8e786f1..a015fa77bc 100644
--- a/.github/workflows/legacy-compilers.yml
+++ b/.github/workflows/legacy-compilers.yml
@@ -226,7 +226,7 @@ jobs:
            examples: False
     runs-on: ${{ matrix.target.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: native build+functest (default)
         uses: ./.github/actions/multi-functest
         with:
@@ -394,7 +394,7 @@ jobs:
            examples: False
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: native build+functest (default)
         uses: ./.github/actions/multi-functest
         with:
@@ -500,7 +500,7 @@ jobs:
          - "15.2.0"
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install MinGW-w64
         run: choco install mingw --version=${{ matrix.mingw-version }} -y
         shell: cmd
@@ -561,7 +561,7 @@ jobs:
           - { family: clang, version: "22",  shell: clang22 }
     runs-on: ${{ matrix.system }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup nix
         uses: ./.github/actions/setup-shell
         with:
diff --git a/.github/workflows/lint_markdown.yml b/.github/workflows/lint_markdown.yml
index cd3858cafe..c45144f47c 100644
--- a/.github/workflows/lint_markdown.yml
+++ b/.github/workflows/lint_markdown.yml
@@ -12,7 +12,7 @@ jobs:
   lint-markdown-link:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - name: Check markdown links
       run: |
         npm install -g markdown-link-check@3.14.2
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index ebc105e075..9d604749af 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -19,7 +19,7 @@ jobs:
     outputs:
       run_needed: ${{ steps.check_run.outputs.run_needed }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: github.event_name != 'workflow_dispatch'
         with:
           fetch-depth: 0
@@ -61,7 +61,7 @@ jobs:
     name: build nix cache (${{ matrix.runner }})
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/actions/setup-nix
         with:
           cache: true
diff --git a/.github/workflows/riscv.yml b/.github/workflows/riscv.yml
index c0d5197530..8ef2a9619f 100644
--- a/.github/workflows/riscv.yml
+++ b/.github/workflows/riscv.yml
@@ -14,7 +14,7 @@ jobs:
     # via https://riseproject-dev.github.io/riscv-runner/
     runs-on: ubuntu-24.04-riscv
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: make quickcheck
         run: |
           OPT=0 make quickcheck
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index 539b0b0b6c..913b61b399 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zephyr.yml b/.github/workflows/zephyr.yml
index c9f8dd0f97..c42ad2715b 100644
--- a/.github/workflows/zephyr.yml
+++ b/.github/workflows/zephyr.yml
@@ -22,7 +22,7 @@ jobs:
           - { board: mps3-an547, cpu: Cortex-M55, opt: all }
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: zephyr build + test
         uses: ./.github/actions/functest
         env: