diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dee89dd..b421fb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fail if PR branch is behind its base branch
@@ -53,10 +53,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Checkout proto sibling (replace ../proto)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           # REPO_ACCESS_TOKEN is a fine-grained PAT with read on the private
@@ -66,7 +66,7 @@ jobs:
       - run: mv _proto_ci ../proto
 
       - name: Checkout common sibling (replace ../common)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -80,7 +80,7 @@ jobs:
       # to developer machines only. INSTANT_API_REPO is set on the test step
       # below so findApiRepoRoot() locates the sibling deterministically.
       - name: Checkout api sibling (for cross-repo registry-iterating tests)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -168,10 +168,10 @@ jobs:
       TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/instant_dev_test?sslmode=disable
       TEST_REDIS_URL: redis://localhost:6379/15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Checkout proto sibling (replace ../proto)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -179,7 +179,7 @@ jobs:
       - run: mv _proto_ci ../proto
 
       - name: Checkout common sibling (replace ../common)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -187,7 +187,7 @@ jobs:
       - run: mv _common_ci ../common
 
       - name: Checkout api sibling (for migrations + cross-repo tests)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index addab12..8c85395 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,16 +20,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: worker
       - name: Checkout sibling InstaNode-dev/common
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/common
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index b483ce5..1c467a4 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -71,21 +71,21 @@ jobs:
       # the drift-detection coverage. Mirrors ci.yml.
       INSTANT_API_REPO: ${{ github.workspace }}/../api
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           path: worker
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
 
       - name: Checkout proto sibling (for go.mod replace ../proto)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: proto
 
       - name: Checkout common sibling (for go.mod replace ../common)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -97,7 +97,7 @@ jobs:
       # in CI, leaving cross-repo drift detection to developer machines
       # only. INSTANT_API_REPO env (set above) locates this checkout.
       - name: Checkout api sibling (for cross-repo registry-iterating tests)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 26a6225..8844550 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -97,10 +97,10 @@ jobs:
       TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/instant_dev_test?sslmode=disable
       TEST_REDIS_URL: redis://localhost:6379/15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Checkout proto sibling (replace ../proto)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -108,7 +108,7 @@ jobs:
       - run: mv _proto_ci ../proto
 
       - name: Checkout common sibling (replace ../common)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -116,7 +116,7 @@ jobs:
       - run: mv _common_ci ../common
 
       - name: Checkout api sibling (for migrations + cross-repo tests)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -159,12 +159,12 @@ jobs:
     needs: integration
     steps:
       - name: Checkout worker (this repo) into ./worker
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: worker
 
       - name: Checkout common sibling into ./common
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           # 2026-05-15: GITHUB_TOKEN is scoped to THIS repo only and 404s
@@ -175,7 +175,7 @@ jobs:
           path: common
 
       - name: Checkout proto sibling into ./proto
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
@@ -188,7 +188,7 @@ jobs:
       # detection to developer machines only. INSTANT_API_REPO is set on the
       # test step below so findApiRepoRoot() locates the sibling deterministically.
       - name: Checkout api sibling into ./api (for cross-repo registry-iterating tests)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 8ede56b..e1f99e2 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -18,18 +18,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           path: worker
       # Sibling checkouts (proto/common) for repos with replace directives.
       # No-op for repos that do not need them.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ hashFiles('worker/go.mod') != '' }}
         with:
           repository: InstaNode-dev/common
           path: common
         continue-on-error: true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 4600ea6..f92fedd 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -17,16 +17,16 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: worker
       - name: Checkout sibling InstaNode-dev/common
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/common
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: InstaNode-dev/proto
           path: proto
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 2c07a4d..a9180db 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 661d167..6f2639a 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: crate-ci/typos@v1.47.2
         continue-on-error: true  # warn-only — surface findings without blocking CI