diff --git a/.github/workflows/ceo-audit.yml b/.github/workflows/ceo-audit.yml
index 1b278de6..88faff1b 100644
--- a/.github/workflows/ceo-audit.yml
+++ b/.github/workflows/ceo-audit.yml
@@ -50,7 +50,7 @@ jobs:
       # lands where the next steps (upload-sarif, comment) expect it.
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # full history for regression detection
 
@@ -241,7 +241,7 @@ jobs:
     timeout-minutes: 2
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f49147f..0685bd79 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/ecosystem-sync.yml b/.github/workflows/ecosystem-sync.yml
index 44f04247..3004c631 100644
--- a/.github/workflows/ecosystem-sync.yml
+++ b/.github/workflows/ecosystem-sync.yml
@@ -17,7 +17,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Every registry server has an ECOSYSTEM.md row
         run: |
diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml
index d38c12b2..a47f0dff 100644
--- a/.github/workflows/go-ci.yml
+++ b/.github/workflows/go-ci.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index db5c1eb4..c45a845f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 31c07c80..744c6862 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -15,7 +15,7 @@ jobs:
     name: build sdist + wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4969db2..ce46b593 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/sin-verify.yml b/.github/workflows/sin-verify.yml
index ede8d20b..eae490f7 100644
--- a/.github/workflows/sin-verify.yml
+++ b/.github/workflows/sin-verify.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/skill-e2e.yml b/.github/workflows/skill-e2e.yml
index 51ee2327..5968122f 100644
--- a/.github/workflows/skill-e2e.yml
+++ b/.github/workflows/skill-e2e.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/swebench-nightly.yml b/.github/workflows/swebench-nightly.yml
index 2273de0c..367114d2 100644
--- a/.github/workflows/swebench-nightly.yml
+++ b/.github/workflows/swebench-nightly.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
diff --git a/.github/workflows/test-delegate.yml b/.github/workflows/test-delegate.yml
index c838a21a..c215e81b 100644
--- a/.github/workflows/test-delegate.yml
+++ b/.github/workflows/test-delegate.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod