diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 49904ed6..22233a06 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ jobs:
     name: Terminology Guard - No Internal Thing Model Terms in Product Surfaces
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Terminology guard self-test (detector canary)
         run: ./scripts/check-terminology.sh --selftest
       - name: Terminology check
@@ -21,7 +21,7 @@ jobs:
     name: Governance Lints - Arch-Doc Triggers, Migration Timestamps, i18n, TZ, Code Bindings
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Need full clone for `git ls-files` + `git show :path` patterns
           # used by check-no-redis-pubsub.mjs / check-hardcoded-agent-paths.mjs.
@@ -86,7 +86,7 @@ jobs:
     name: Frontend - Type Check, Test, Build (control-plane-ui + ui-shared)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 20
@@ -117,7 +117,7 @@ jobs:
     name: DB Migrate - Seed Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 20
@@ -140,7 +140,7 @@ jobs:
     name: Security Scanning
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           # Pinned (not `stable`) so the govulncheck gate is reproducible:
diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index 26b54ddb..6ddd7224 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -50,7 +50,7 @@ jobs:
       agent-ui: ${{ steps.detect.outputs.agent-ui }}
       integration: ${{ steps.detect.outputs.integration }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - id: detect
@@ -130,7 +130,7 @@ jobs:
       matrix:
         module: ${{ fromJson(needs.detect-modules.outputs.modules) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
@@ -170,7 +170,7 @@ jobs:
     name: Core-path 100% coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
@@ -197,7 +197,7 @@ jobs:
       matrix:
         module: ${{ fromJson(needs.detect-modules.outputs.lint-modules) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
@@ -244,7 +244,7 @@ jobs:
     # without running Vite first.
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
@@ -265,7 +265,7 @@ jobs:
     if: needs.detect-modules.outputs.integration == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
@@ -288,7 +288,7 @@ jobs:
     name: Workspace integrity
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'