diff --git a/.github/workflows/ci-native-linux.yml b/.github/workflows/ci-native-linux.yml
index 59f167d..b66fb78 100644
--- a/.github/workflows/ci-native-linux.yml
+++ b/.github/workflows/ci-native-linux.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/ci-steamdeck-package.yml b/.github/workflows/ci-steamdeck-package.yml
index a7a587d..dfe149e 100644
--- a/.github/workflows/ci-steamdeck-package.yml
+++ b/.github/workflows/ci-steamdeck-package.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51ee683..6958772 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
       run:
         working-directory: signal
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
         with:
@@ -36,7 +36,7 @@ jobs:
       run:
         working-directory: native/shared
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -57,7 +57,7 @@ jobs:
     name: Native macOS Shell (SwiftUI)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - uses: dtolnay/rust-toolchain@stable
       - name: Clone bolt-core-sdk (sibling dependency)
         run: git clone --depth 1 https://github.com/bolt-ecosystem/bolt-core-sdk.git "${{ github.workspace }}/../bolt-core-sdk"
@@ -95,7 +95,7 @@ jobs:
     name: Signal Subtree Drift Guard
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - name: Read subtree pin
         shell: bash
@@ -106,7 +106,7 @@ jobs:
           echo "UPSTREAM_TAG=$UPSTREAM_TAG" >> "$GITHUB_ENV"
 
       - name: Checkout canonical bolt-rendezvous
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
         with:
           repository: ${{ env.UPSTREAM_REPO }}
           ref: ${{ env.UPSTREAM_TAG }}
diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml
index a38fc51..712c507 100644
--- a/.github/workflows/windows-ci.yml
+++ b/.github/workflows/windows-ci.yml
@@ -14,7 +14,7 @@ jobs:
       run:
         working-directory: signal
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
         with: