diff --git a/.github/workflows/foundation-ci.yml b/.github/workflows/foundation-ci.yml
index 641c0b4..7c06e60 100644
--- a/.github/workflows/foundation-ci.yml
+++ b/.github/workflows/foundation-ci.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - uses: actions/dependency-review-action@v5.0.0
         with:
           fail-on-severity: high
@@ -27,8 +27,8 @@ jobs:
     name: Hygiene
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/checkout@v7.0.0
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.11"
       - name: Secret/private export scan
@@ -51,8 +51,8 @@ jobs:
           - sx/s0s1-rest-bff
           - sx/are-api-gateway
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: actions/setup-go@v6.4.0
+      - uses: actions/checkout@v7.0.0
+      - uses: actions/setup-go@v6.5.0
         with:
           go-version: "1.25.x"
           cache-dependency-path: ${{ matrix.module }}/go.sum
@@ -70,7 +70,7 @@ jobs:
           - s0/immutable-ledger
           - s1/scope-evaluator-runtime
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - name: Install stable Rust
         run: rustup default stable
       - name: cargo test
@@ -84,7 +84,7 @@ jobs:
       run:
         working-directory: s1/opa-integration-layer
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - uses: actions/setup-node@v6.4.0
         with:
           node-version: "24"
@@ -99,8 +99,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [hygiene, go, rust, node]
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/checkout@v7.0.0
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.11"
       - name: Start foundation stack
diff --git a/.github/workflows/release-readiness.yml b/.github/workflows/release-readiness.yml
index 3cf2213..0c547a4 100644
--- a/.github/workflows/release-readiness.yml
+++ b/.github/workflows/release-readiness.yml
@@ -20,8 +20,8 @@ jobs:
     name: Release readiness gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/checkout@v7.0.0
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.11"
       - name: Audit public release boundary