diff --git a/.github/workflows/ai-eval.yml b/.github/workflows/ai-eval.yml
index 9abb5372cd..2d80137c8e 100644
--- a/.github/workflows/ai-eval.yml
+++ b/.github/workflows/ai-eval.yml
@@ -67,7 +67,7 @@ jobs:
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -89,7 +89,7 @@ jobs:
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -115,7 +115,7 @@ jobs:
       JUDGE_PROVIDER: ${{ secrets.JUDGE_PROVIDER }}
       JUDGE_API_KEY: ${{ secrets.JUDGE_API_KEY }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/backup-restore-drill.yml b/.github/workflows/backup-restore-drill.yml
index 1967b15e3e..aa33f839f0 100644
--- a/.github/workflows/backup-restore-drill.yml
+++ b/.github/workflows/backup-restore-drill.yml
@@ -74,7 +74,7 @@ jobs:
       TARGET_DB: teslasync_drill_restored
       TARGET_GUARD: restore-drill-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
diff --git a/.github/workflows/capacity-test.yml b/.github/workflows/capacity-test.yml
index 052e46e80b..1b7029932c 100644
--- a/.github/workflows/capacity-test.yml
+++ b/.github/workflows/capacity-test.yml
@@ -61,7 +61,7 @@ jobs:
     # Below safety.max_duration (30m) with room for stack boot/teardown.
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be3ae426e5..1c1fcf1e75 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
     # feature mirror, the SLO rules/dashboards).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: "26"
@@ -73,7 +73,7 @@ jobs:
       matrix:
         check: [lint, architecture]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -120,7 +120,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -155,7 +155,7 @@ jobs:
     env:
       CGO_ENABLED: 1
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -217,7 +217,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -267,7 +267,7 @@ jobs:
       matrix:
         binary: [teslasync, notification-worker, export-worker]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
@@ -299,7 +299,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: "26"
@@ -337,7 +337,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: "26"
@@ -370,7 +370,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v5
         with:
@@ -447,7 +447,7 @@ jobs:
           - image: web
             file: Dockerfile.web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: docker/setup-buildx-action@v4
 
       - name: Build ${{ matrix.image }}
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index 1cfaa5d459..a078eac145 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -35,7 +35,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@v5
         with:
           node-version: '22'
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 547f8b50f0..b7e63eb17c 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       # ── Go toolchain ──────────────────────────────────────────
       - name: Set up Go
diff --git a/.github/workflows/deploy-rollback.yml b/.github/workflows/deploy-rollback.yml
index 73ad008073..74af48e521 100644
--- a/.github/workflows/deploy-rollback.yml
+++ b/.github/workflows/deploy-rollback.yml
@@ -96,7 +96,7 @@ jobs:
       verdict: ${{ steps.evaluate.outputs.verdict }}
       automation_allowed: ${{ steps.evaluate.outputs.automation_allowed }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -189,7 +189,7 @@ jobs:
     # a production rollback safe.
     environment: ${{ inputs.environment }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 56fcdbbc29..39aec44fa9 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -32,7 +32,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/fleet-proto-drift.yml b/.github/workflows/fleet-proto-drift.yml
index bdd2475b2a..abf3c68f23 100644
--- a/.github/workflows/fleet-proto-drift.yml
+++ b/.github/workflows/fleet-proto-drift.yml
@@ -17,7 +17,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Test the drift detector
         run: python3 -m unittest discover -s scripts -p 'test_check_fleet_proto_drift.py'
       - name: Fetch the current upstream schema at a fixed revision
diff --git a/.github/workflows/frontend-quality.yml b/.github/workflows/frontend-quality.yml
index 14c620d8aa..d90b9c2692 100644
--- a/.github/workflows/frontend-quality.yml
+++ b/.github/workflows/frontend-quality.yml
@@ -40,7 +40,7 @@ jobs:
     name: Route registry and test discovery
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -73,7 +73,7 @@ jobs:
     name: Shared hermetic browser build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -106,7 +106,7 @@ jobs:
           - {name: accessibility, suite: a11y, shard: '1/1'}
           - {name: performance, suite: performance, shard: '1/1'}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -158,7 +158,7 @@ jobs:
       matrix:
         browser: [firefox, webkit]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -195,7 +195,7 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
@@ -244,7 +244,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: contract
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
         with:
           node-version: '26'
diff --git a/.github/workflows/helm-ci.yml b/.github/workflows/helm-ci.yml
index 97932eb4ce..1b1a4e7740 100644
--- a/.github/workflows/helm-ci.yml
+++ b/.github/workflows/helm-ci.yml
@@ -33,7 +33,7 @@ jobs:
     name: Lint Chart
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -69,7 +69,7 @@ jobs:
     name: Template Validation
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - uses: azure/setup-helm@v5
         with:
@@ -148,7 +148,7 @@ jobs:
     name: Schema Validation
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - uses: azure/setup-helm@v5
         with:
@@ -171,7 +171,7 @@ jobs:
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/load-test.yml b/.github/workflows/load-test.yml
index 3840b0780f..523d1213ab 100644
--- a/.github/workflows/load-test.yml
+++ b/.github/workflows/load-test.yml
@@ -48,7 +48,7 @@ jobs:
     runs-on: ${{ github.event.inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Boot ephemeral TeslaSync stack
         env:
diff --git a/.github/workflows/ops-gate.yml b/.github/workflows/ops-gate.yml
index ab697d8d3c..895cc88dac 100644
--- a/.github/workflows/ops-gate.yml
+++ b/.github/workflows/ops-gate.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -91,7 +91,7 @@ jobs:
       PGPASSWORD: fixture
       DB_URL: postgres://fixture:fixture@localhost:5432/teslasync_fixture?sslmode=disable
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -153,7 +153,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index e4c7b68427..0d3c4cb36a 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -35,7 +35,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v5
         with:
diff --git a/.github/workflows/post-deploy-smoke.yml b/.github/workflows/post-deploy-smoke.yml
index 70dd7f5b26..65d13e6631 100644
--- a/.github/workflows/post-deploy-smoke.yml
+++ b/.github/workflows/post-deploy-smoke.yml
@@ -76,7 +76,7 @@ jobs:
     outputs:
       passed: ${{ steps.run.outputs.passed }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
diff --git a/.github/workflows/proto-gen-check.yml b/.github/workflows/proto-gen-check.yml
index 8be9d14d5a..cdc8b876c2 100644
--- a/.github/workflows/proto-gen-check.yml
+++ b/.github/workflows/proto-gen-check.yml
@@ -20,7 +20,7 @@ jobs:
     name: Verify generated Tesla protomodel matches proto
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a633b69a7..3103002396 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,7 +63,7 @@ jobs:
             fi
           done
 
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -187,7 +187,7 @@ jobs:
           - image: fleet-telemetry
             file: Dockerfile.fleet-telemetry
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
       - name: Prepare the promotion directory
@@ -347,7 +347,7 @@ jobs:
       summary: ${{ steps.aggregate.outputs.summary }}
       blocking: ${{ steps.aggregate.outputs.blocking }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download vulnerability scans
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -427,7 +427,7 @@ jobs:
         # No `file` / `build-args` here: this stage does NOT build.
         image: [api, web, notification-worker, export-worker, automation-worker, fleet-telemetry]
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
@@ -639,7 +639,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
@@ -678,7 +678,7 @@ jobs:
       contents: write
       packages: read
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 4729031bf5..86c401dfee 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -52,7 +52,7 @@ jobs:
     name: Security Scan
     runs-on: ${{ inputs.runner || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install CodeQL runtime prerequisites
         run: |
diff --git a/.github/workflows/si-canonical-gate.yml b/.github/workflows/si-canonical-gate.yml
index b2fed3bbac..c6ccc582c2 100644
--- a/.github/workflows/si-canonical-gate.yml
+++ b/.github/workflows/si-canonical-gate.yml
@@ -40,7 +40,7 @@ jobs:
     name: Block new legacy unit-suffixed identifiers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           # Fetch enough history to compute the diff against the merge
           # base. depth: 0 is wasteful but reliable on shallow clones.