diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ca28558..9fb2c3da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     # This job runs on push, PR, and all manual triggers (regardless of input)
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Cargo Cache
         uses: actions/cache@v5
         with:
@@ -86,7 +86,7 @@ jobs:
     name: Code Quality Checks
     runs-on: [self-hosted, linux, x64, rust-cpu]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions-rs/toolchain@v1
         with:
           profile: minimal
@@ -138,7 +138,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, rust-cpu]
     # This job runs on push, PR, and all manual triggers (regardless of input)
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Cargo Cache
         uses: actions/cache@v5
         with:
@@ -203,7 +203,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, rust-cpu]
     # Run safety verification on all pushes and PRs
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Cargo Cache
         uses: actions/cache@v5
         with:
@@ -259,7 +259,7 @@ jobs:
     # Run on pushes to main and manual triggers
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Setup Bazel
         uses: bazel-contrib/setup-bazel@0.19.0
         with:
@@ -284,7 +284,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.run_extended_analysis == true # Compare to boolean true
     needs: [ci_checks_and_docs, core_tests_and_analysis, safety_verification] # Optional: wait for other jobs
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Cargo Cache
         uses: actions/cache@v5
         with:
@@ -325,7 +325,7 @@ jobs:
     name: Code Coverage
     runs-on: [self-hosted, linux, x64, rust-cpu]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/cache@v5
         with:
           path: |
@@ -364,7 +364,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     continue-on-error: ${{ matrix.continue-on-error || false }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions-rs/audit-check@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -375,7 +375,7 @@ jobs:
     # Real cross-compilation with VxWorks SDK — runs on push to main and manual triggers
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Cache VxWorks SDK
         id: cache-vxworks-sdk
         uses: actions/cache@v5
diff --git a/.github/workflows/kani-verification.yml b/.github/workflows/kani-verification.yml
index db9f7899..9a5e6bff 100644
--- a/.github/workflows/kani-verification.yml
+++ b/.github/workflows/kani-verification.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -99,7 +99,7 @@ jobs:
             package: kiln-foundation
     
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' || github.event_name == 'schedule'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/pr-diagnostics.yml b/.github/workflows/pr-diagnostics.yml
index 25500206..701c79ae 100644
--- a/.github/workflows/pr-diagnostics.yml
+++ b/.github/workflows/pr-diagnostics.yml
@@ -17,7 +17,7 @@ jobs:
     
     steps:
     - name: Checkout PR
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7
       with:
         # Fetch full history for diff analysis
         fetch-depth: 0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d68cb766..728e00c7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # We need history to get tags
           fetch-depth: 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f95b27f3..84d968f2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,7 +85,7 @@ jobs:
       TARGET: ${{ matrix.target }}
       ARCHIVE_KIND: ${{ matrix.archive }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
           submodules: recursive
@@ -175,7 +175,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
           submodules: recursive
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 00acf794..4745c3c4 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -17,7 +17,7 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -70,7 +70,7 @@ jobs:
     name: Safety Analysis with Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -131,7 +131,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high