diff --git a/.github/workflows/bi-demo-smoke.yml b/.github/workflows/bi-demo-smoke.yml
index cf1d3c4e..8715e001 100644
--- a/.github/workflows/bi-demo-smoke.yml
+++ b/.github/workflows/bi-demo-smoke.yml
@@ -33,7 +33,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install jq
         run: sudo apt-get update && sudo apt-get install -y jq
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0043fc8d..903b8774 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build, test, run detekt and verify coverage
         # --no-build-cache: kover-Verify konsumiert die `.exec`-Daten
@@ -38,7 +38,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-results
           path: '**/build/test-results/test/*.xml'
@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload coverage reports
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-reports
           path: '**/build/reports/kover/html/**'
@@ -54,7 +54,7 @@ jobs:
 
       - name: Upload detekt reports
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: detekt-reports
           path: '**/build/reports/detekt/**'
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload release assets
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-assets
           path: adapters/driving/cli/build/release/*
@@ -77,7 +77,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify Kover excludes ledger and Markdown links
         # Fail-closed Doku-Gate, das bisher nur lokal (`make gates`/`make ci`)
@@ -100,14 +100,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build OCI image locally
         run: make docker-oci-build
 
       - name: Login to GitHub Container Registry
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -149,7 +149,7 @@ jobs:
 
       - name: Login to Docker Hub
         if: steps.dockerhub.outputs.enabled == 'true'
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -185,7 +185,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build the native runtime image
         # Dieselbe Stage wie `make native-runtime-build` lokal: volle CLI nativ (GraalVM) im
@@ -206,7 +206,7 @@ jobs:
             || { echo "::error::native image validate smoke failed"; exit 1; }
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -240,7 +240,7 @@ jobs:
 
       - name: Login to Docker Hub
         if: steps.dockerhub.outputs.enabled == 'true'
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/coverage-modules.yml b/.github/workflows/coverage-modules.yml
index d4fdeb88..2cbb5ed5 100644
--- a/.github/workflows/coverage-modules.yml
+++ b/.github/workflows/coverage-modules.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Print per-module coverage summary
         # Apples-to-apples mit `make docker-coverage-modules` lokal — gleicher
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index 16cea303..be43f4d0 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Explizit, weil dieser Workflow als einziger Gradle direkt auf dem Runner
       # faehrt statt im gradle:8.12-jdk21-Image wie der uebrige Build.
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index f8854b4f..f67c42d8 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run integration tests (all modules with @integration tag)
         # Plan §6.16: generischer Aufruf, sodass neue integration-Tests in
diff --git a/.github/workflows/native-image.yml b/.github/workflows/native-image.yml
index 6f0cf37e..312bc289 100644
--- a/.github/workflows/native-image.yml
+++ b/.github/workflows/native-image.yml
@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # ZWEI JDKs, bewusst getrennt — dieselbe Aufteilung wie docker/native-image.Dockerfile:
       #   GRAALVM_HOME = GraalVM 25 -> hier laeuft native-image
@@ -76,7 +76,7 @@ jobs:
       # native-build-tools-Plugin genau diese Variable verwenden.
       - name: Set up GraalVM 25 (fuer native-image)
         # Bringt auf Windows auch den MSVC-Kontext mit, den native-image dort zum Linken braucht.
-        uses: graalvm/setup-graalvm@8c5543b71f44568342e106336639979e94a8f6de # v1.6.1
+        uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1.6.3
         with:
           java-version: '25'
           distribution: 'graalvm-community'
@@ -224,7 +224,7 @@ jobs:
             || { echo "::error::generate produced no CREATE TABLE"; exit 1; }
 
       - name: Upload native binary
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: d-migrate-native-${{ steps.stage.outputs.platform }}
           path: dist/*
@@ -246,7 +246,7 @@ jobs:
 
     steps:
       - name: Download native binaries from all matrix legs
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: d-migrate-native-*
           merge-multiple: true
diff --git a/.github/workflows/perf-acceptance.yml b/.github/workflows/perf-acceptance.yml
index 794dea6c..788cc6b8 100644
--- a/.github/workflows/perf-acceptance.yml
+++ b/.github/workflows/perf-acceptance.yml
@@ -44,7 +44,7 @@ jobs:
     # nicht das Job-Limit (sonst kein Collect/Upload). Start-Budget, im Lauf zu validieren.
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify docker compose available
         run: docker compose version
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload perf results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           # run_attempt im Namen: github.run_id bleibt bei Re-runs gleich, upload-artifact
           # verlangt eindeutige Namen (ohne overwrite) -> sonst Kollision.
diff --git a/.github/workflows/release-homebrew.yml b/.github/workflows/release-homebrew.yml
index 0639577b..057ab2b3 100644
--- a/.github/workflows/release-homebrew.yml
+++ b/.github/workflows/release-homebrew.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Derive release metadata
         id: meta
diff --git a/.github/workflows/sample-db-cross-smoke-pg2my.yml b/.github/workflows/sample-db-cross-smoke-pg2my.yml
index a80037a3..a4e9e75e 100644
--- a/.github/workflows/sample-db-cross-smoke-pg2my.yml
+++ b/.github/workflows/sample-db-cross-smoke-pg2my.yml
@@ -34,7 +34,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify docker compose available
         run: docker compose version
diff --git a/.github/workflows/sample-db-cross-smoke.yml b/.github/workflows/sample-db-cross-smoke.yml
index d9ead7eb..ca6b4109 100644
--- a/.github/workflows/sample-db-cross-smoke.yml
+++ b/.github/workflows/sample-db-cross-smoke.yml
@@ -35,7 +35,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify docker compose available
         run: docker compose version
diff --git a/.github/workflows/sample-db-scale.yml b/.github/workflows/sample-db-scale.yml
index 7ef6fc92..e5c2924d 100644
--- a/.github/workflows/sample-db-scale.yml
+++ b/.github/workflows/sample-db-scale.yml
@@ -33,7 +33,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify docker compose available
         run: docker compose version
diff --git a/.github/workflows/sample-db-smoke.yml b/.github/workflows/sample-db-smoke.yml
index 511c9e94..703a25fb 100644
--- a/.github/workflows/sample-db-smoke.yml
+++ b/.github/workflows/sample-db-smoke.yml
@@ -33,7 +33,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify docker compose available
         run: docker compose version
diff --git a/.github/workflows/sample-db-spatial-smoke.yml b/.github/workflows/sample-db-spatial-smoke.yml
index 613f3903..bad32373 100644
--- a/.github/workflows/sample-db-spatial-smoke.yml
+++ b/.github/workflows/sample-db-spatial-smoke.yml
@@ -37,7 +37,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify docker compose available
         run: docker compose version
diff --git a/.github/workflows/sample-db-sqlite-smoke.yml b/.github/workflows/sample-db-sqlite-smoke.yml
index 571df88c..1516c417 100644
--- a/.github/workflows/sample-db-sqlite-smoke.yml
+++ b/.github/workflows/sample-db-sqlite-smoke.yml
@@ -33,7 +33,7 @@ jobs:
     continue-on-error: true
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Ensure sqlite3 is available
         run: sqlite3 --version
diff --git a/.github/workflows/verify-homebrew-formula.yml b/.github/workflows/verify-homebrew-formula.yml
index 2e38c40e..92d1392d 100644
--- a/.github/workflows/verify-homebrew-formula.yml
+++ b/.github/workflows/verify-homebrew-formula.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Read formula metadata
         id: formula