diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eede943..d5e995c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
           - surface: persistence
             command: npm run test:persistence
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -38,7 +38,7 @@ jobs:
   compatibility:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -48,7 +48,7 @@ jobs:
   smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 22
@@ -60,7 +60,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 22
diff --git a/.github/workflows/codeql-light.yml b/.github/workflows/codeql-light.yml
index 9a47396..779a562 100644
--- a/.github/workflows/codeql-light.yml
+++ b/.github/workflows/codeql-light.yml
@@ -67,7 +67,7 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == matrix.category }}
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: false
 
diff --git a/.github/workflows/corehub-cli-npm-release.yml b/.github/workflows/corehub-cli-npm-release.yml
index de8fa4b..924975a 100644
--- a/.github/workflows/corehub-cli-npm-release.yml
+++ b/.github/workflows/corehub-cli-npm-release.yml
@@ -46,7 +46,7 @@ jobs:
           exit 1
 
       - name: Checkout release tag
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
@@ -192,7 +192,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout release tag
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 1f886ba..87595a4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -121,7 +121,7 @@ jobs:
           echo "Package: $COREHUB_SMOKE_PACKAGE"
           echo "Actor: $COREHUB_USER"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/operator-smoke.yml b/.github/workflows/operator-smoke.yml
index 067152e..906f063 100644
--- a/.github/workflows/operator-smoke.yml
+++ b/.github/workflows/operator-smoke.yml
@@ -43,7 +43,7 @@ jobs:
       COREHUB_USER: ${{ vars.COREHUB_USER || 'github:coreblow-admin' }}
       VERIFY_READ: ${{ inputs.verify_read || false }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/package-publish.yml b/.github/workflows/package-publish.yml
index b3f931d..789bc6b 100644
--- a/.github/workflows/package-publish.yml
+++ b/.github/workflows/package-publish.yml
@@ -102,7 +102,7 @@ jobs:
     env:
       COREHUB_SOURCE_PATH: corehub-source
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
 
@@ -164,7 +164,7 @@ jobs:
               fh.write(f"ref={workflow_sha}\n")
           PY
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: ${{ steps.corehub_source.outputs.repository }}
           ref: ${{ steps.corehub_source.outputs.ref }}
diff --git a/.github/workflows/production-drill.yml b/.github/workflows/production-drill.yml
index c6d89fb..226fd5f 100644
--- a/.github/workflows/production-drill.yml
+++ b/.github/workflows/production-drill.yml
@@ -66,7 +66,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/production-seed.yml b/.github/workflows/production-seed.yml
index 1f17163..2947b5e 100644
--- a/.github/workflows/production-seed.yml
+++ b/.github/workflows/production-seed.yml
@@ -68,7 +68,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 0446685..721d837 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0