diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index e964c2ba..7641f98b 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 90
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Setup Nix
       uses: ./.github/actions/setup-nix
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f1e0e44c..d2a3bfd6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,7 +30,7 @@ jobs:
     outputs:
       code_changes: ${{ github.event_name == 'workflow_dispatch' || steps.filter.outputs.code_changes }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       if: github.event_name != 'workflow_dispatch'
 
     - name: Detect build-relevant changes
@@ -60,7 +60,7 @@ jobs:
     timeout-minutes: 30
     needs: changes
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         ref: ${{ inputs.ref }}
 
@@ -99,7 +99,7 @@ jobs:
     timeout-minutes: 30
     needs: [changes, build]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         ref: ${{ inputs.ref }}
 
@@ -144,7 +144,7 @@ jobs:
     timeout-minutes: 30
     needs: [changes, unit-test]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         ref: ${{ inputs.ref }}
 
diff --git a/.github/workflows/model-update-checker.yml b/.github/workflows/model-update-checker.yml
index 9d66620a..92a63a95 100644
--- a/.github/workflows/model-update-checker.yml
+++ b/.github/workflows/model-update-checker.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ github.token }}
 
diff --git a/.github/workflows/opencode-audit.yml b/.github/workflows/opencode-audit.yml
index c7633a64..a4a43f99 100644
--- a/.github/workflows/opencode-audit.yml
+++ b/.github/workflows/opencode-audit.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ secrets.OPENCODE_PAT }}
 
diff --git a/.github/workflows/opencode-pr.yml b/.github/workflows/opencode-pr.yml
index 468ae5f0..19eea470 100644
--- a/.github/workflows/opencode-pr.yml
+++ b/.github/workflows/opencode-pr.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.head_sha || github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/opencode-test-writer.yml b/.github/workflows/opencode-test-writer.yml
index f36879b3..1402f8e1 100644
--- a/.github/workflows/opencode-test-writer.yml
+++ b/.github/workflows/opencode-test-writer.yml
@@ -36,7 +36,7 @@ jobs:
       # or a fine-grained PAT with Contents: Read & Write on this repository.
       # Without write permission, git push will fail with 403.
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0
diff --git a/.github/workflows/opencode-triage.yml b/.github/workflows/opencode-triage.yml
index d5fa8cbd..add6d7ef 100644
--- a/.github/workflows/opencode-triage.yml
+++ b/.github/workflows/opencode-triage.yml
@@ -41,7 +41,7 @@ jobs:
             return days >= 30;
           result-encoding: string
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: steps.check.outputs.result == 'true'
         with:
           token: ${{ github.token }}
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index d90049d7..b5576b62 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -26,7 +26,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ secrets.OPENCODE_PAT }}
 
diff --git a/.github/workflows/repo-automation.yml b/.github/workflows/repo-automation.yml
index 6746cc22..f54c4ccd 100644
--- a/.github/workflows/repo-automation.yml
+++ b/.github/workflows/repo-automation.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Label Issue
         uses: actions/github-script@v9
diff --git a/.github/workflows/stale-branch-cleanup.yml b/.github/workflows/stale-branch-cleanup.yml
index 922ddfad..274852e5 100644
--- a/.github/workflows/stale-branch-cleanup.yml
+++ b/.github/workflows/stale-branch-cleanup.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Delete stale branches behind dev
         env:
diff --git a/.github/workflows/visual-test.yml b/.github/workflows/visual-test.yml
index 251ffaaf..a5537c79 100644
--- a/.github/workflows/visual-test.yml
+++ b/.github/workflows/visual-test.yml
@@ -17,7 +17,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: ./.github/actions/setup-nix
diff --git a/.github/workflows/workflow-validation.yml b/.github/workflows/workflow-validation.yml
index 0dac8537..8dbdb41d 100644
--- a/.github/workflows/workflow-validation.yml
+++ b/.github/workflows/workflow-validation.yml
@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Run actionlint
         uses: reviewdog/action-actionlint@v1
@@ -36,7 +36,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Parse workflow YAML
         run: |