diff --git a/.github/workflows/aevum-dev-images.yaml b/.github/workflows/aevum-dev-images.yaml
index 490b1770..547df216 100644
--- a/.github/workflows/aevum-dev-images.yaml
+++ b/.github/workflows/aevum-dev-images.yaml
@@ -23,7 +23,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
 
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 4f3789a3..d71f3d0d 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 85db04cb..2286bed2 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -49,7 +49,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index a1077761..a4d7ea09 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -14,13 +14,13 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
 
diff --git a/.github/workflows/dev-images.yaml b/.github/workflows/dev-images.yaml
index 8cac6810..4a839797 100644
--- a/.github/workflows/dev-images.yaml
+++ b/.github/workflows/dev-images.yaml
@@ -24,7 +24,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
       - name: Debug
diff --git a/.github/workflows/django-tests.yaml b/.github/workflows/django-tests.yaml
index eacb74fe..98e3fb08 100644
--- a/.github/workflows/django-tests.yaml
+++ b/.github/workflows/django-tests.yaml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_CI_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_CI_PRIVATE_KEY }}
diff --git a/.github/workflows/prod-images.yaml b/.github/workflows/prod-images.yaml
index 6c18b858..bcb81dca 100644
--- a/.github/workflows/prod-images.yaml
+++ b/.github/workflows/prod-images.yaml
@@ -26,7 +26,7 @@ jobs:
         dockerfile: [ "web", "worker", "beat" ]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
       - name: Debug
diff --git a/.github/workflows/ruff-check.yaml b/.github/workflows/ruff-check.yaml
index 704efd81..a3371286 100644
--- a/.github/workflows/ruff-check.yaml
+++ b/.github/workflows/ruff-check.yaml
@@ -17,13 +17,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
index 629f8b74..3cc3515b 100644
--- a/.github/workflows/sonar.yaml
+++ b/.github/workflows/sonar.yaml
@@ -17,15 +17,35 @@ jobs:
       pull-requests: write
 
     steps:
+      # SECURITY NOTE: allow-unsafe-pr-checkout is required because this workflow
+      # uses `workflow_run` to trigger after the Coverage workflow completes.
+      # In actions/checkout@v7+, fork PR checkouts are blocked by default for
+      # `workflow_run` triggers (see: https://github.com/actions/checkout/releases/tag/v7.0.0).
+      #
+      # Why we need it:
+      # - We must checkout the actual PR code to run SonarCloud analysis on pull requests
+      # - Without this flag, the workflow would fail when analyzing forks' PRs
+      #
+      # Mitigating factors for our use case:
+      # 1. This workflow only runs on `github.repository == 'fragforce/fragforce.org'`
+      #    - It will NOT run on fork repositories, so the "pwn request" attack vector doesn't apply
+      # 2. The checkout happens in a trusted context (official GitHub Actions runner)
+      # 3. We're not using `pull_request_target` (more dangerous) but `workflow_run`
+      # 4. Coverage data is downloaded from GitHub's artifact system, not user input
+      # 5. SonarCloud analysis is read-only - it scans code, doesn't execute or modify it
+      #
+      # See: https://github.com/actions/checkout/security/advisories/GHSA-wr3m-4mph-g9w6
+
       - name: Checkout PR code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
+          allow-unsafe-pr-checkout: true
 
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_CI_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_CI_PRIVATE_KEY }}
@@ -49,7 +69,7 @@ jobs:
           echo "SONAR_BRANCH_NAME=$BRANCH" >> "$GITHUB_ENV"
 
       - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: 21
diff --git a/.github/workflows/sync-dev-to-master.yaml b/.github/workflows/sync-dev-to-master.yaml
index 4b4a3bdd..4353f709 100644
--- a/.github/workflows/sync-dev-to-master.yaml
+++ b/.github/workflows/sync-dev-to-master.yaml
@@ -15,13 +15,13 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.FRAGFORCE_AUTOMATION_APP_ID }}
           private-key: ${{ secrets.FRAGFORCE_AUTOMATION_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/validate-release.yaml b/.github/workflows/validate-release.yaml
index 3303ddae..432a5b40 100644
--- a/.github/workflows/validate-release.yaml
+++ b/.github/workflows/validate-release.yaml
@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0