diff --git a/.github/workflows/check-agent-removal-impact.yml b/.github/workflows/check-agent-removal-impact.yml
index 8e40ef0..9de6e02 100644
--- a/.github/workflows/check-agent-removal-impact.yml
+++ b/.github/workflows/check-agent-removal-impact.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Checkout PR branch
         if: steps.changes.outputs.relevant == 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index a86eb4e..a6593ba 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -27,7 +27,7 @@ jobs:
       has_agents: ${{ steps.classify.outputs.has_agents }}
       has_docs_only: ${{ steps.classify.outputs.has_docs_only }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -88,14 +88,14 @@ jobs:
       #   2. `pr/`      — PR head, the untrusted *content* the validator scans.
       # The runner only ever invokes Python that lives under `trusted/`.
       - name: Checkout trusted base (for validator scripts)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           fetch-depth: 1
           path: trusted
 
       - name: Checkout PR head (content under review — never executed)
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -190,7 +190,7 @@ jobs:
     env:
       GIT_LFS_SKIP_SMUDGE: "1"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 4830a4d..5da528f 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Checkout
         if: github.event_name != 'pull_request' || steps.changes.outputs.relevant == 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         if: github.event_name != 'pull_request' || steps.changes.outputs.relevant == 'true'
diff --git a/.github/workflows/update-registry.yml b/.github/workflows/update-registry.yml
index e038678..04d81f9 100644
--- a/.github/workflows/update-registry.yml
+++ b/.github/workflows/update-registry.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Full history needed so the commit author is resolved correctly
           fetch-depth: 1
diff --git a/.github/workflows/validate-agent-schemas.yml b/.github/workflows/validate-agent-schemas.yml
index 262ffab..74c01ce 100644
--- a/.github/workflows/validate-agent-schemas.yml
+++ b/.github/workflows/validate-agent-schemas.yml
@@ -27,7 +27,7 @@ jobs:
       # as data and never executes PR-supplied code.
 
       - name: Checkout PR branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/validate-everything.yml b/.github/workflows/validate-everything.yml
index ad687b2..2e374e2 100644
--- a/.github/workflows/validate-everything.yml
+++ b/.github/workflows/validate-everything.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/validate-starter-kit-schema.yml b/.github/workflows/validate-starter-kit-schema.yml
index 3c030b2..1ce8197 100644
--- a/.github/workflows/validate-starter-kit-schema.yml
+++ b/.github/workflows/validate-starter-kit-schema.yml
@@ -43,7 +43,7 @@ jobs:
 
       - name: Checkout PR branch
         if: steps.changes.outputs.relevant == 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         if: steps.changes.outputs.relevant == 'true'
diff --git a/.github/workflows/validate-starter-kits.yml b/.github/workflows/validate-starter-kits.yml
index 315ce61..3ba61ae 100644
--- a/.github/workflows/validate-starter-kits.yml
+++ b/.github/workflows/validate-starter-kits.yml
@@ -37,7 +37,7 @@ jobs:
 
       - name: Checkout PR branch
         if: steps.changes.outputs.relevant == 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0