diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44a27c4..5d3cc48 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,10 +10,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Checkout proto sibling (replace ../proto)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7d08b06..c7a4550 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,11 +20,11 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index d8a0b54..8d1e549 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           path: common
           # Full history so diff-cover can resolve origin/<base_ref> for the
           # patch-coverage gate below (shallow clones lack the base commit).
           fetch-depth: 0
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 417d5a9..21dcbe0 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -18,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           path: common
       # Sibling checkout (proto) — common itself is the repo under test, so
       # only proto is fetched as a sibling for the replace directive.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index eb1a73d..3cebe21 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -17,11 +17,11 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 2c07a4d..a9180db 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 661d167..6f2639a 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: crate-ci/typos@v1.47.2
         continue-on-error: true  # warn-only — surface findings without blocking CI