diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d64e40e2..cd5bb97d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
     name: frontend
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -59,7 +59,7 @@ jobs:
     name: rustfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -74,7 +74,7 @@ jobs:
     name: clippy-stable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -89,7 +89,7 @@ jobs:
     name: cargo-deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -105,7 +105,7 @@ jobs:
     name: unused-deps
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: bnjbvr/cargo-machete@v0.9.2
 
@@ -113,7 +113,7 @@ jobs:
     name: third-party-licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -137,7 +137,7 @@ jobs:
     name: docs-fresh
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -158,7 +158,7 @@ jobs:
     name: rustdoc
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -174,7 +174,7 @@ jobs:
     name: rust-beta-build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -188,7 +188,7 @@ jobs:
     name: msrv
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -202,7 +202,7 @@ jobs:
     name: rust-stable-test / linux-without-docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -218,7 +218,7 @@ jobs:
     name: rust-stable-test / linux-with-docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -248,7 +248,7 @@ jobs:
     name: escape-positive-control
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -273,7 +273,7 @@ jobs:
         os: [macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -292,7 +292,7 @@ jobs:
     name: rust-beta-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -308,7 +308,7 @@ jobs:
     name: cargo-package
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -343,7 +343,7 @@ jobs:
     name: benchmark-gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -376,7 +376,7 @@ jobs:
     name: corpus-marker-audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5a7ea414..51b0a0f8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/corpus_promote.yml b/.github/workflows/corpus_promote.yml
index 744c7109..509deef4 100644
--- a/.github/workflows/corpus_promote.yml
+++ b/.github/workflows/corpus_promote.yml
@@ -33,7 +33,7 @@ jobs:
     name: Propose corpus promotions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index bcc9b344..b333d892 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -23,7 +23,7 @@ jobs:
   build-deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
diff --git a/.github/workflows/dynamic.yml b/.github/workflows/dynamic.yml
index da2cdc95..a8a8f891 100644
--- a/.github/workflows/dynamic.yml
+++ b/.github/workflows/dynamic.yml
@@ -48,7 +48,7 @@ jobs:
       # docker-unavailable paths cannot accidentally hide a regression.
       NYX_SANDBOX_BACKEND: process
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -81,7 +81,7 @@ jobs:
     name: dynamic / linux-with-docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -121,7 +121,7 @@ jobs:
       # pick up a stray Lima/Colima daemon and confuse the matrix.
       NYX_SANDBOX_BACKEND: process
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index b7ea9200..334fc3ef 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -63,7 +63,7 @@ jobs:
       # dev reference stays 10 min — override locally to tighten.
       NYX_OWASP_WALLCLOCK_BUDGET_SECONDS: "1200"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -146,7 +146,7 @@ jobs:
       # CI wall-clock budget: 15 min.  Override locally to tighten.
       NYX_JSTS_WALLCLOCK_BUDGET_SECONDS: "900"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
@@ -260,7 +260,7 @@ jobs:
       # CI wall-clock budget: 15 min.  Override locally to tighten.
       NYX_POLYGLOT_WALLCLOCK_BUDGET_SECONDS: "900"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index eb24b2e4..af35bd49 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -30,7 +30,7 @@ jobs:
       matrix:
         target: [scan_bytes, extract_summaries, cross_file_taint]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # cargo-fuzz needs nightly for the libFuzzer codegen flags.
       - uses: actions-rust-lang/setup-rust-toolchain@v1
@@ -169,7 +169,7 @@ jobs:
           - cap: html_escape
             harness: tests/dynamic_fixtures/python/xss_positive.py
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
diff --git a/.github/workflows/image-builder.yml b/.github/workflows/image-builder.yml
index f1497072..d8a82891 100644
--- a/.github/workflows/image-builder.yml
+++ b/.github/workflows/image-builder.yml
@@ -28,7 +28,7 @@ jobs:
     name: refresh image digests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 605899f4..1c3d6f1d 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_TAG }}
 
@@ -68,7 +68,7 @@ jobs:
 
     steps:
       - name: Check out sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_TAG }}
 
@@ -153,7 +153,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Check out sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_TAG }}
 
@@ -211,7 +211,7 @@ jobs:
       attestations: write
     steps:
       - name: Check out sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_TAG }}
 
diff --git a/.github/workflows/repro-bare.yml b/.github/workflows/repro-bare.yml
index 9f78ebbe..60a1dee4 100644
--- a/.github/workflows/repro-bare.yml
+++ b/.github/workflows/repro-bare.yml
@@ -40,7 +40,7 @@ jobs:
         fixture:
           - tests/repro_fixtures/python-3.11/repro
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Block host language toolchains
         run: |
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 42757097..18a36e1c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false