diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 93f27e6..3968611 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
     name: build + integration gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 973d668..e1eadc6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: cli
       - uses: actions/setup-go@v6
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index c385d5c..6977e64 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,17 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           path: cli
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/common
           path: common
         continue-on-error: true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 06e318c..f3df79a 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -18,18 +18,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           path: cli
       # Sibling checkouts (proto/common) for repos with replace directives.
       # No-op for repos that do not need them.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ hashFiles('cli/go.mod') != '' }}
         with:
           repository: InstaNode-dev/common
           path: common
         continue-on-error: true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index a21c819..b4c0956 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: cli
       - uses: actions/setup-go@v6
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 2c07a4d..a9180db 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ffcf31c..a2bf62a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
       # Full history + tags are required so GoReleaser can read the tag
       # message and infer changelog scope.
       - name: Checkout (full history + tags)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 661d167..6f2639a 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: crate-ci/typos@v1.47.2
         continue-on-error: true  # warn-only — surface findings without blocking CI