diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index ea865090..9c4ee2a4 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # Install Bun directly — avoids `apt-get update` (9+ min in this
       # container) which setup-bun needs for unzip.
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e8480ae1..95bdb836 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9e699a3e..875f427a 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Bun
         run: python3 tools/install-bun
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 669cd674..70a1db6d 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Pages
         uses: actions/configure-pages@v6
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
index ae6915ee..c53c0fe9 100644
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Checkout published commit
         # actions/checkout v6.0.2
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           ref: ${{ inputs.target_sha }}
           fetch-depth: 0
diff --git a/.github/workflows/lint-and-typecheck.yml b/.github/workflows/lint-and-typecheck.yml
index b3fd0b3e..5c507ca8 100644
--- a/.github/workflows/lint-and-typecheck.yml
+++ b/.github/workflows/lint-and-typecheck.yml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/publish-check.yml b/.github/workflows/publish-check.yml
index d9de07a0..0b1fb950 100644
--- a/.github/workflows/publish-check.yml
+++ b/.github/workflows/publish-check.yml
@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 038c4b47..4d9a6a0f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # changesets/action commits version bumps via the GitHub API
           # (commitMode: github-api) so we deliberately disable
@@ -102,7 +102,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         # persist-credentials defaults to true so `changeset publish`
         # can push per-package git tags (@tko/utils@X.Y.Z, etc.) via
         # the runner's git remote auth. The repo-wide vX.Y.Z tag is
diff --git a/.github/workflows/test-headless.yml b/.github/workflows/test-headless.yml
index fe2c7632..23621887 100644
--- a/.github/workflows/test-headless.yml
+++ b/.github/workflows/test-headless.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # Install Bun directly — avoids `apt-get update` (9+ min in this
       # container) which setup-bun needs for unzip.
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Bun
         run: python3 tools/install-bun