diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index 9c5ccb2..95277fd 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -24,7 +24,7 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'benchmark')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ade9fcf..86ae06e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
 
diff --git a/.github/workflows/docs-backfill.yaml b/.github/workflows/docs-backfill.yaml
index 47ceeda..887b6ba 100644
--- a/.github/workflows/docs-backfill.yaml
+++ b/.github/workflows/docs-backfill.yaml
@@ -65,7 +65,7 @@ jobs:
           echo "Backfilling docs for release tag: ${RELEASE_TAG}"
 
       - name: Checkout (full history for mike + git-revision-date plugins)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: master
diff --git a/.github/workflows/documentation.yaml b/.github/workflows/documentation.yaml
index 784cc56..153151e 100644
--- a/.github/workflows/documentation.yaml
+++ b/.github/workflows/documentation.yaml
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for mike + git-revision-date plugins)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for mike + git-revision-date plugins)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for mike + git-revision-date plugins)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: master
diff --git a/.github/workflows/native-core-build.yml b/.github/workflows/native-core-build.yml
index d308e6a..3d7e2f5 100644
--- a/.github/workflows/native-core-build.yml
+++ b/.github/workflows/native-core-build.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python
         uses: actions/setup-python@v6
diff --git a/.github/workflows/native-pin-consistency.yml b/.github/workflows/native-pin-consistency.yml
index 81cdfac..6c77e27 100644
--- a/.github/workflows/native-pin-consistency.yml
+++ b/.github/workflows/native-pin-consistency.yml
@@ -20,7 +20,7 @@ jobs:
     name: aa-* crates share one git rev
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Assert all agent-assembly git deps share one rev
         run: |
           manifest="native/aa-ffi-python/Cargo.toml"
diff --git a/.github/workflows/release-python-conversion-test.yml b/.github/workflows/release-python-conversion-test.yml
index 576fb23..63470d7 100644
--- a/.github/workflows/release-python-conversion-test.yml
+++ b/.github/workflows/release-python-conversion-test.yml
@@ -42,7 +42,7 @@ jobs:
     name: Run tag → PEP 440 fixture suite
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Lint conversion + test scripts
         run: |
           shellcheck .github/scripts/tag-to-pep440.sh
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 4e16fc3..2d728a3 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -58,7 +58,7 @@ jobs:
       # and its inverse (.github/scripts/pep440-to-tag.sh). Those scripts
       # are the single source of truth for the conversion, shared with the
       # AAASM-2863 / AAASM-2956 unit tests.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: r
         env:
           EVENT_NAME: ${{ github.event_name }}
@@ -158,7 +158,7 @@ jobs:
     needs: resolve
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
@@ -191,7 +191,7 @@ jobs:
     needs: resolve
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
@@ -274,7 +274,7 @@ jobs:
     needs: resolve
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
@@ -346,7 +346,7 @@ jobs:
     needs: resolve
     runs-on: macos-14  # Apple silicon runner
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
@@ -401,7 +401,7 @@ jobs:
     needs: resolve
     runs-on: macos-15-intel  # Intel runner (macos-13 sunset 2025-09-19)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
@@ -499,7 +499,7 @@ jobs:
     permissions:
       contents: write  # create the git tag + GitHub Release
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Create tag and GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/rw_run_all_test_and_record.yaml b/.github/workflows/rw_run_all_test_and_record.yaml
index ca71cdd..710e667 100644
--- a/.github/workflows/rw_run_all_test_and_record.yaml
+++ b/.github/workflows/rw_run_all_test_and_record.yaml
@@ -153,7 +153,7 @@ jobs:
     needs: build-and-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Required by SonarCloud to correctly compute PR/new-code deltas.
           fetch-depth: 0
diff --git a/.github/workflows/type-check.yml b/.github/workflows/type-check.yml
index e44fe52..15a8580 100644
--- a/.github/workflows/type-check.yml
+++ b/.github/workflows/type-check.yml
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -128,7 +128,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7