diff --git a/.github/workflows/beat-speed-nightly.yml b/.github/workflows/beat-speed-nightly.yml
index 805ef261dd..abed057f22 100644
--- a/.github/workflows/beat-speed-nightly.yml
+++ b/.github/workflows/beat-speed-nightly.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: [self-hosted, X64, Linux]
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Ensure uv is available (for scikit-learn baselines)
         run: |
diff --git a/.github/workflows/binary-release.yml b/.github/workflows/binary-release.yml
index 5f144e835d..115e50f352 100644
--- a/.github/workflows/binary-release.yml
+++ b/.github/workflows/binary-release.yml
@@ -72,7 +72,7 @@ jobs:
           echo "Building pv for $TAG → ${{ matrix.target }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
diff --git a/.github/workflows/book-contracts.yml b/.github/workflows/book-contracts.yml
index 42cdfd8cb2..e3b555e6fd 100644
--- a/.github/workflows/book-contracts.yml
+++ b/.github/workflows/book-contracts.yml
@@ -35,7 +35,7 @@ jobs:
     name: Chapter Examples Compile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -60,7 +60,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: chapter-examples-compile
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -92,7 +92,7 @@ jobs:
     name: Book Integration Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -105,7 +105,7 @@ jobs:
     name: Contract Enforcement
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Every chapter has a contract
         run: |
           FAIL=0
@@ -165,7 +165,7 @@ jobs:
     name: Namespace Discipline
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: No legacy imports in chapter examples
         run: |
           FAIL=0
@@ -206,7 +206,7 @@ jobs:
     name: SUMMARY.md Integrity
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: No dead links in SUMMARY.md
         run: |
           FAIL=0
diff --git a/.github/workflows/book.yml b/.github/workflows/book.yml
index 9b1773fa14..3149e6c841 100644
--- a/.github/workflows/book.yml
+++ b/.github/workflows/book.yml
@@ -26,7 +26,7 @@ jobs:
     name: Build Book
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install mdBook
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 534364366a..ba04ea7ef8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,7 +89,7 @@ jobs:
       IMAGE: localhost:5000/sovereign-ci:stable
       PR_OR_REF: ${{ github.event.pull_request.number || github.ref_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Pull sovereign-ci image (with retry + local-cache fallback)
         # Self-hosted runner's local Docker registry at localhost:5000 is
         # occasionally restarting OR experiencing extended outages
@@ -379,7 +379,7 @@ jobs:
       # via repo variable MUTANTS_MAX_MISSED if a diff legitimately can't reach 0.
       MUTANTS_MAX_MISSED: ${{ vars.MUTANTS_MAX_MISSED || '0' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Need history + base branch to compute the PR diff for --in-diff.
           fetch-depth: 0
diff --git a/.github/workflows/coverage-nightly.yml b/.github/workflows/coverage-nightly.yml
index c4c000e82e..edc76987bd 100644
--- a/.github/workflows/coverage-nightly.yml
+++ b/.github/workflows/coverage-nightly.yml
@@ -36,7 +36,7 @@ jobs:
       # pristine tree, and the default git-clean choked on root-owned leftovers
       # (e.g. contracts/.pv/cache from prior `pv` jobs → EACCES on rmdir),
       # failing checkout before any coverage ran.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           clean: false
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 555c6c9c65..6b75a76391 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -26,7 +26,7 @@ jobs:
       has_commits: ${{ steps.check.outputs.has_commits }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -61,7 +61,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -133,7 +133,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
diff --git a/.github/workflows/qwen-story-daily.yml b/.github/workflows/qwen-story-daily.yml
index a0ea71dbdb..b845994b5e 100644
--- a/.github/workflows/qwen-story-daily.yml
+++ b/.github/workflows/qwen-story-daily.yml
@@ -45,7 +45,7 @@ jobs:
       PMAT_HUNT: ${{ github.event.inputs.pmat_hunt || '1' }}
       RUST_BACKTRACE: '1'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1