diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 684f62a..ff90c3b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
         working-directory: src
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -45,7 +45,7 @@ jobs:
   build-and-test-windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -73,7 +73,7 @@ jobs:
   lint-shell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: shellcheck hooks and wrappers
         run: |
@@ -83,7 +83,7 @@ jobs:
   lint-actions:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Run the tool author's image directly rather than a third-party
       # wrapper action — one less link in the supply chain.
@@ -93,7 +93,7 @@ jobs:
   hook-smoke-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # The devkit-guard shell wrappers exec the Go engine binary.
       # Provide Go so hooks_test.sh can build it on first run (the
@@ -116,7 +116,7 @@ jobs:
   fresh-install-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Bootstrap wrapper must exist and be executable
         run: |
@@ -204,7 +204,7 @@ jobs:
       run:
         working-directory: mcpb/launcher
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -239,7 +239,7 @@ jobs:
   mcpb-bundle-integrity:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Sources sidecar must exist
         run: |
@@ -300,7 +300,7 @@ jobs:
   validate-counts:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Validate README and ROADMAP counts
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8131a4..f06a0bd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
       merge_sha: ${{ steps.resolve.outputs.merge_sha }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -99,7 +99,7 @@ jobs:
     outputs:
       release_created: ${{ steps.create_release.outputs.release_created }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ needs.version.outputs.merge_sha }}
@@ -164,7 +164,7 @@ jobs:
         os: [linux, darwin, windows]
         arch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.version.outputs.merge_sha }}
 
@@ -197,7 +197,7 @@ jobs:
     if: needs.create-release.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download all release assets and generate checksums
         env:
@@ -234,7 +234,7 @@ jobs:
       needs.version.outputs.bumped == 'auto'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ssh-key: ${{ secrets.VERSION_BUMP_KEY }}
           fetch-depth: 0
@@ -294,7 +294,7 @@ jobs:
        needs.publish.result == 'failure' || needs.publish.result == 'cancelled')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Delete draft release on failure
         env: