diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b498140..c44bd44 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: "${{ inputs.environment }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: aws-actions/configure-aws-credentials@v4
         with: { role-to-assume: "${{ secrets.AWS_DEPLOY_ROLE_ARN }}", aws-region: us-east-1 }
       - uses: aws-actions/amazon-ecr-login@v2
diff --git a/.github/workflows/load.yml b/.github/workflows/load.yml
index 7ab783a..4a52200 100644
--- a/.github/workflows/load.yml
+++ b/.github/workflows/load.yml
@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: staging
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: grafana/setup-k6-action@v1
       - uses: grafana/run-k6-action@v1
         with: { path: infra/load/k6.js }
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 7b4fab0..2bce102 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -8,14 +8,14 @@ jobs:
   codeql:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v3
         with: { languages: javascript-typescript }
       - uses: github/codeql-action/analyze@v3
   secrets-and-dependencies:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
       - uses: gitleaks/gitleaks-action@v2
       - uses: oven-sh/setup-bun@v2
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy: { matrix: { service: [api, worker, admin] } }
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: docker build --build-arg NEXT_PUBLIC_API_URL=http://localhost:3000 -f apps/${{ matrix.service }}/Dockerfile -t voiceforge-${{ matrix.service }}:${{ github.sha }} .
       - uses: aquasecurity/trivy-action@0.28.0
         with: { image-ref: "voiceforge-${{ matrix.service }}:${{ github.sha }}", format: sarif, output: "trivy-${{ matrix.service }}.sarif", severity: "CRITICAL,HIGH", exit-code: "1" }
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 9435b8d..90380b9 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -38,7 +38,7 @@ jobs:
         image: redis:7-alpine
         ports: ["6379:6379"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with: { bun-version: 1.3.14 }
       - run: bun install --frozen-lockfile
@@ -52,7 +52,7 @@ jobs:
   containers-and-terraform:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: hashicorp/setup-terraform@v3
         with: { terraform_version: 1.10.5 }
       - run: terraform -chdir=infra/terraform fmt -check -recursive