diff --git a/.github/workflows/a2a-maintain.yml b/.github/workflows/a2a-maintain.yml
index d2eb22e2..5b932d05 100644
--- a/.github/workflows/a2a-maintain.yml
+++ b/.github/workflows/a2a-maintain.yml
@@ -113,7 +113,7 @@ jobs:
     outputs:
       declared: ${{ steps.check.outputs.declared }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Is a2a-maintain declared?
         id: check
@@ -204,7 +204,7 @@ jobs:
         # compromises). This workflow holds `contents: write` on the PR branch, so a
         # repointed checkout would run attacker code with push access. Semgrep's
         # github-actions-mutable-action-tag rule flags the unpinned form.
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 72bc4517..15de94d9 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Enable auto-merge
         if: github.event.pull_request.user.login == github.repository_owner || contains(github.event.pull_request.labels.*.name, 'auto-merge')
@@ -65,7 +65,7 @@ jobs:
       # deliberately not run: `--list-dirs` only reads package.json files and
       # uses node builtins, so the preinstalled node is enough.
       - name: Checkout the merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
 
diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index 9144e30e..71687886 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -232,7 +232,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use Node.js 24.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
diff --git a/.github/workflows/billing-invoices-e2e.yml b/.github/workflows/billing-invoices-e2e.yml
index f5a4b435..f0770000 100644
--- a/.github/workflows/billing-invoices-e2e.yml
+++ b/.github/workflows/billing-invoices-e2e.yml
@@ -69,7 +69,7 @@ jobs:
       run:
         working-directory: tests/e2e/billing-invoices
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
@@ -116,7 +116,7 @@ jobs:
       run:
         working-directory: tests/e2e/billing-invoices
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/billing-service-tests.yml b/.github/workflows/billing-service-tests.yml
index 5f419428..69b06807 100644
--- a/.github/workflows/billing-service-tests.yml
+++ b/.github/workflows/billing-service-tests.yml
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - name: Use Node.js 24.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
diff --git a/.github/workflows/build-android-apk.yml b/.github/workflows/build-android-apk.yml
index e1fc388f..119a8aac 100644
--- a/.github/workflows/build-android-apk.yml
+++ b/.github/workflows/build-android-apk.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
diff --git a/.github/workflows/ci-queue-watch.yml b/.github/workflows/ci-queue-watch.yml
index ae0747f8..bccacf88 100644
--- a/.github/workflows/ci-queue-watch.yml
+++ b/.github/workflows/ci-queue-watch.yml
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.12'
@@ -58,7 +58,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ee3f46f..c5bb340a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -129,7 +129,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -195,7 +195,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -276,7 +276,7 @@ jobs:
       # unchanged. The rest of this file still uses mutable tags — pinning it
       # wholesale is a separate, security-owned change.
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -323,7 +323,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -371,7 +371,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -425,7 +425,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -466,7 +466,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -543,7 +543,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -613,7 +613,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -714,7 +714,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
diff --git a/.github/workflows/claude-auto-pr.yml b/.github/workflows/claude-auto-pr.yml
index 000b1655..a4a03398 100644
--- a/.github/workflows/claude-auto-pr.yml
+++ b/.github/workflows/claude-auto-pr.yml
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608  # v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/claude-autofix-post-prod.yml b/.github/workflows/claude-autofix-post-prod.yml
index 15a129a5..86421bfc 100644
--- a/.github/workflows/claude-autofix-post-prod.yml
+++ b/.github/workflows/claude-autofix-post-prod.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index cf5e1db6..35149369 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -34,7 +34,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608  # v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v5
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/config-client-py-publish.yml b/.github/workflows/config-client-py-publish.yml
index 230982ab..82fc5cd8 100644
--- a/.github/workflows/config-client-py-publish.yml
+++ b/.github/workflows/config-client-py-publish.yml
@@ -36,7 +36,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-python@v7
         with: { python-version: '3.12' }
diff --git a/.github/workflows/custom-hostname-client-tests.yml b/.github/workflows/custom-hostname-client-tests.yml
index 7eb02922..5ece3dde 100644
--- a/.github/workflows/custom-hostname-client-tests.yml
+++ b/.github/workflows/custom-hostname-client-tests.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout FuzeFront
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Read pinned FuzeInfra commit
         id: pin
@@ -47,7 +47,7 @@ jobs:
           echo "Pinned FuzeInfra commit: $COMMIT"
 
       - name: Checkout FuzeInfra at the pinned commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: izzywdev/FuzeInfra
           ref: ${{ steps.pin.outputs.commit }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 93ef8fe0..fe571b9a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node.js
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -88,7 +88,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
@@ -272,7 +272,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
diff --git a/.github/workflows/design-approval.yml b/.github/workflows/design-approval.yml
index 1038a362..2daea5cc 100644
--- a/.github/workflows/design-approval.yml
+++ b/.github/workflows/design-approval.yml
@@ -68,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Actions pinned to immutable commit SHAs (repo hardening standard).
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           ref: master   # frames + the manifest we flip live on master
 
diff --git a/.github/workflows/ds-claude-agent.yml b/.github/workflows/ds-claude-agent.yml
index 25c82a72..17262384 100644
--- a/.github/workflows/ds-claude-agent.yml
+++ b/.github/workflows/ds-claude-agent.yml
@@ -29,7 +29,7 @@ jobs:
       id-token: write
       actions: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve LLM endpoint (LiteLLM in-cluster, vendor fallback)
         id: llm
diff --git a/.github/workflows/ds-propagate.yml b/.github/workflows/ds-propagate.yml
index 3b273dd5..6be4ec12 100644
--- a/.github/workflows/ds-propagate.yml
+++ b/.github/workflows/ds-propagate.yml
@@ -27,7 +27,7 @@ jobs:
       summary: ${{ steps.summarise.outputs.summary }}
       changed_files: ${{ steps.summarise.outputs.changed_files }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 27cc964f..dc4c45ef 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -48,7 +48,7 @@ jobs:
       BASE_URL: http://localhost:4173
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/fuze-ci-autofix.yml b/.github/workflows/fuze-ci-autofix.yml
index 1d940cae..0ce03631 100644
--- a/.github/workflows/fuze-ci-autofix.yml
+++ b/.github/workflows/fuze-ci-autofix.yml
@@ -99,7 +99,7 @@ jobs:
 
       - name: Checkout PR head branch
         if: steps.keys.outputs.present == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.event.workflow_run.head_branch }}
diff --git a/.github/workflows/fuzequality-release.yml b/.github/workflows/fuzequality-release.yml
index 30987916..fcaf2d9e 100644
--- a/.github/workflows/fuzequality-release.yml
+++ b/.github/workflows/fuzequality-release.yml
@@ -24,7 +24,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
diff --git a/.github/workflows/gate-frames-first.yml b/.github/workflows/gate-frames-first.yml
index d394cd7a..3299ae83 100644
--- a/.github/workflows/gate-frames-first.yml
+++ b/.github/workflows/gate-frames-first.yml
@@ -55,7 +55,7 @@ jobs:
     steps:
       # Actions pinned to immutable commit SHAs (repo hardening standard — a mutable
       # tag can be silently repointed by the action owner).
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # the gate diffs against the merge base
 
diff --git a/.github/workflows/gate-frames-stamped.yml b/.github/workflows/gate-frames-stamped.yml
index da6e12ea..429c6680 100644
--- a/.github/workflows/gate-frames-stamped.yml
+++ b/.github/workflows/gate-frames-stamped.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       # Actions pinned to immutable commit SHAs (repo hardening standard — a mutable
       # tag can be silently repointed by the action owner).
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
diff --git a/.github/workflows/gate-fuze-code-action.yml b/.github/workflows/gate-fuze-code-action.yml
index 6198ae7c..74376730 100644
--- a/.github/workflows/gate-fuze-code-action.yml
+++ b/.github/workflows/gate-fuze-code-action.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Pinned to a full commit SHA, not a mutable tag: a tag can be silently
       # repointed by the action owner (cf. the trivy-action / kics-github-action
diff --git a/.github/workflows/gate-line-endings.yml b/.github/workflows/gate-line-endings.yml
index a04cbc57..3dea098a 100644
--- a/.github/workflows/gate-line-endings.yml
+++ b/.github/workflows/gate-line-endings.yml
@@ -50,7 +50,7 @@ jobs:
   gate-line-endings:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/gate-mcp-contract.yml b/.github/workflows/gate-mcp-contract.yml
index 278dfb18..7512015d 100644
--- a/.github/workflows/gate-mcp-contract.yml
+++ b/.github/workflows/gate-mcp-contract.yml
@@ -63,7 +63,7 @@ jobs:
   gate-mcp-contract:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with: { node-version: '24' }
 
diff --git a/.github/workflows/gate-openapi-conformance.yml b/.github/workflows/gate-openapi-conformance.yml
index 83dcd491..046b1283 100644
--- a/.github/workflows/gate-openapi-conformance.yml
+++ b/.github/workflows/gate-openapi-conformance.yml
@@ -55,7 +55,7 @@ jobs:
     name: shipped code matches the frozen contract
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
diff --git a/.github/workflows/gate-required-check-triggers.yml b/.github/workflows/gate-required-check-triggers.yml
index bbfdfda3..2bf9f31c 100644
--- a/.github/workflows/gate-required-check-triggers.yml
+++ b/.github/workflows/gate-required-check-triggers.yml
@@ -24,6 +24,6 @@ jobs:
     name: gate-required-check-triggers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check required-check workflows run unconditionally on pull_request
         run: node scripts/check-required-check-triggers.mjs
diff --git a/.github/workflows/gate-required-checks.yml b/.github/workflows/gate-required-checks.yml
index 84b38a3f..e605ec68 100644
--- a/.github/workflows/gate-required-checks.yml
+++ b/.github/workflows/gate-required-checks.yml
@@ -84,7 +84,7 @@ jobs:
     # had this job stamped onto the very pool it audits.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with: { python-version: '3.12' }
       - name: Self-test the gate (asserts it FAILS on each measured defect)
diff --git a/.github/workflows/gate-route-ownership.yml b/.github/workflows/gate-route-ownership.yml
index ea7978a2..3b4a0846 100644
--- a/.github/workflows/gate-route-ownership.yml
+++ b/.github/workflows/gate-route-ownership.yml
@@ -52,7 +52,7 @@ jobs:
     name: API paths are served by the service that implements them
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
diff --git a/.github/workflows/gate-sealed-keys.yml b/.github/workflows/gate-sealed-keys.yml
index 79eca380..0a4bdeee 100644
--- a/.github/workflows/gate-sealed-keys.yml
+++ b/.github/workflows/gate-sealed-keys.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for base comparison)
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608  # v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/google-oauth-e2e.yml b/.github/workflows/google-oauth-e2e.yml
index a9e4c6e1..2cc56964 100644
--- a/.github/workflows/google-oauth-e2e.yml
+++ b/.github/workflows/google-oauth-e2e.yml
@@ -84,7 +84,7 @@ jobs:
       AUTHENTIK_COOKIE_DOMAIN: ${{ inputs.tunnel_hostname || 'auth-dev.fuzefront.com' }}
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/governance-nightly.yml b/.github/workflows/governance-nightly.yml
index 42d35cb6..02861583 100644
--- a/.github/workflows/governance-nightly.yml
+++ b/.github/workflows/governance-nightly.yml
@@ -28,7 +28,7 @@ jobs:
   reconcile:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/governance-sync.yml b/.github/workflows/governance-sync.yml
index 3af06b94..12a516fa 100644
--- a/.github/workflows/governance-sync.yml
+++ b/.github/workflows/governance-sync.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (PR head)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -59,7 +59,7 @@ jobs:
 
       - name: Fetch FuzeSDLC canonical (read-only key)
         if: steps.guard.outputs.ok == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: izzywdev/FuzeSDLC
           ref: ${{ steps.ref.outputs.ref }}
diff --git a/.github/workflows/harden-gate.yml b/.github/workflows/harden-gate.yml
index bee26406..a30375ff 100644
--- a/.github/workflows/harden-gate.yml
+++ b/.github/workflows/harden-gate.yml
@@ -25,7 +25,7 @@ jobs:
   gate-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: { node-version: '24.x' }
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -48,7 +48,7 @@ jobs:
   gate-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: { node-version: '24.x' }
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -68,7 +68,7 @@ jobs:
   gate-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: { node-version: '24.x' }
       - name: Build (adaptive, report-only)
@@ -83,7 +83,7 @@ jobs:
   gate-sast:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Semgrep (report-only, SARIF)
         shell: bash
         run: |
@@ -119,7 +119,7 @@ jobs:
   gate-secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { fetch-depth: 0 }
 
       # Runs the gitleaks BINARY, not gitleaks-action. Adopted from the FuzeSDLC canonical
@@ -189,7 +189,7 @@ jobs:
       security-events: write
       pull-requests: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Trivy filesystem scan (report-only, SARIF)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
         with:
@@ -287,7 +287,7 @@ jobs:
     # ratchets to enforcing per-repo once the rules are tuned green (see architecture-guidelines.md).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { fetch-depth: 0 }
       - name: Semgrep authz/appsec scan (report-only, SARIF)
         shell: bash
@@ -317,7 +317,7 @@ jobs:
     # FuzeInfra#760 (permit-schema-sync with no deadline).
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { submodules: recursive }
       - name: Consumer-test bounded up + smoke
         shell: bash
@@ -355,7 +355,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { fetch-depth: 0 }
       - name: SemVer bump check (packages + API contracts, report-only)
         shell: bash
@@ -408,7 +408,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GITHUB_REPOSITORY: ${{ github.repository }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { fetch-depth: 0 }
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with: { python-version: '3.12' }
@@ -475,7 +475,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with: { fetch-depth: 0 }
 
       - name: Can this job reach the gateway?
@@ -543,7 +543,7 @@ jobs:
     # per repo once the billing-service contract annotates/allowlists its collection GETs.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with: { python-version: '3.12' }
       - name: Pagination gate (report-only)
@@ -575,7 +575,7 @@ jobs:
     # Ratchet it to enforcing once that backlog is cleared.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with: { python-version: '3.12' }
       - name: Identifier gate — self-tests (the gate must be known to FIRE)
@@ -632,7 +632,7 @@ jobs:
     # gate — see the script's docstring for why.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with: { python-version: '3.12' }
       - name: Vacuous-check gate — self-tests (the gate must be known to FIRE)
@@ -666,7 +666,7 @@ jobs:
     # no backlog to ratchet.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: { node-version: '24.x' }
       - name: Toolchain floor gate
@@ -684,7 +684,7 @@ jobs:
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24.x'
diff --git a/.github/workflows/helm-validate.yml b/.github/workflows/helm-validate.yml
index 2898b304..87a7773d 100644
--- a/.github/workflows/helm-validate.yml
+++ b/.github/workflows/helm-validate.yml
@@ -37,7 +37,7 @@ jobs:
             sudo apt-get install -y --no-install-recommends ca-certificates
             sudo update-ca-certificates
           fi
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
diff --git a/.github/workflows/i18n-translate.yml b/.github/workflows/i18n-translate.yml
index 11a24c02..7a884832 100644
--- a/.github/workflows/i18n-translate.yml
+++ b/.github/workflows/i18n-translate.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
diff --git a/.github/workflows/identity-py-publish.yml b/.github/workflows/identity-py-publish.yml
index f8aa30fa..695c267f 100644
--- a/.github/workflows/identity-py-publish.yml
+++ b/.github/workflows/identity-py-publish.yml
@@ -34,7 +34,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-python@v7
         with: { python-version: '3.12' }
diff --git a/.github/workflows/image-reproducibility.yml b/.github/workflows/image-reproducibility.yml
index 65394c5f..b8e1f27e 100644
--- a/.github/workflows/image-reproducibility.yml
+++ b/.github/workflows/image-reproducibility.yml
@@ -32,7 +32,7 @@ jobs:
     name: Dockerfiles install from the lockfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24.x'
@@ -74,7 +74,7 @@ jobs:
             context: clock-app
             file: clock-app/Dockerfile
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - name: Build ${{ matrix.name }} image
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
diff --git a/.github/workflows/infra-dispatch.yml b/.github/workflows/infra-dispatch.yml
index f8802e35..c64aefa2 100644
--- a/.github/workflows/infra-dispatch.yml
+++ b/.github/workflows/infra-dispatch.yml
@@ -33,7 +33,7 @@ jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index 3e1a224b..b1ba7735 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -44,7 +44,7 @@ jobs:
   label-sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Upsert labels from .github/labels.json
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/mcp-descriptions-refresh.yml b/.github/workflows/mcp-descriptions-refresh.yml
index e06667cf..d92f5dc2 100644
--- a/.github/workflows/mcp-descriptions-refresh.yml
+++ b/.github/workflows/mcp-descriptions-refresh.yml
@@ -44,7 +44,7 @@ jobs:
   refresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with: { node-version: '24' }
 
diff --git a/.github/workflows/mcp-gateway-image.yml b/.github/workflows/mcp-gateway-image.yml
index fdb07f62..b5c6e5b2 100644
--- a/.github/workflows/mcp-gateway-image.yml
+++ b/.github/workflows/mcp-gateway-image.yml
@@ -38,7 +38,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
diff --git a/.github/workflows/mcp-maintain.yml b/.github/workflows/mcp-maintain.yml
index 7c816102..e338abc7 100644
--- a/.github/workflows/mcp-maintain.yml
+++ b/.github/workflows/mcp-maintain.yml
@@ -60,7 +60,7 @@ jobs:
     outputs:
       declared: ${{ steps.check.outputs.declared }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Is mcp-maintain declared?
         id: check
@@ -118,7 +118,7 @@ jobs:
         # repointed by the action owner (cf. the trivy-action / kics-github-action
         # compromises). This workflow has `contents: write` on the PR branch, so a
         # repointed checkout would run attacker code with push access.
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/nightly-e2e.yml b/.github/workflows/nightly-e2e.yml
index c9f62ced..16224516 100644
--- a/.github/workflows/nightly-e2e.yml
+++ b/.github/workflows/nightly-e2e.yml
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout (with FuzeInfra submodule)
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
           submodules: recursive
diff --git a/.github/workflows/nightly-integration.yml b/.github/workflows/nightly-integration.yml
index 2c955160..bdb2f6f3 100644
--- a/.github/workflows/nightly-integration.yml
+++ b/.github/workflows/nightly-integration.yml
@@ -40,7 +40,7 @@ jobs:
     outputs:
       ran: ${{ steps.detect.outputs.ran }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
           fetch-depth: 0
@@ -153,7 +153,7 @@ jobs:
     # past a real deadline either.
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Resolve LLM endpoint (LiteLLM in-cluster, vendor fallback)
diff --git a/.github/workflows/oidc-plumbing-e2e.yml b/.github/workflows/oidc-plumbing-e2e.yml
index 11777404..2a909cd5 100644
--- a/.github/workflows/oidc-plumbing-e2e.yml
+++ b/.github/workflows/oidc-plumbing-e2e.yml
@@ -58,7 +58,7 @@ jobs:
       E2E_USER_PASSWORD: E2eP@ssw0rd123
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/onboarding-kit-tests.yml b/.github/workflows/onboarding-kit-tests.yml
index 47dbcf96..8d241fa6 100644
--- a/.github/workflows/onboarding-kit-tests.yml
+++ b/.github/workflows/onboarding-kit-tests.yml
@@ -26,7 +26,7 @@ jobs:
       run:
         working-directory: packages/onboarding-kit
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
diff --git a/.github/workflows/packages-publish.yml b/.github/workflows/packages-publish.yml
index 09b85c99..50b5834b 100644
--- a/.github/workflows/packages-publish.yml
+++ b/.github/workflows/packages-publish.yml
@@ -112,7 +112,7 @@ jobs:
     outputs:
       packages: ${{ steps.list.outputs.packages }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
@@ -155,7 +155,7 @@ jobs:
       matrix:
         package: ${{ fromJson(needs.verify.outputs.packages) }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/pages-frames.yml b/.github/workflows/pages-frames.yml
index 181f9dd6..b457d359 100644
--- a/.github/workflows/pages-frames.yml
+++ b/.github/workflows/pages-frames.yml
@@ -36,7 +36,7 @@ jobs:
       # Actions pinned to immutable commit SHAs (repo hardening standard — a mutable
       # tag can be silently repointed by the action owner; see the trivy-action /
       # kics-github-action compromises).
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
         with:
diff --git a/.github/workflows/portal-federation-health.yml b/.github/workflows/portal-federation-health.yml
index 000d1965..021e65b2 100644
--- a/.github/workflows/portal-federation-health.yml
+++ b/.github/workflows/portal-federation-health.yml
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
@@ -119,7 +119,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/post-prod-e2e.yml b/.github/workflows/post-prod-e2e.yml
index 03de0f80..90980f35 100644
--- a/.github/workflows/post-prod-e2e.yml
+++ b/.github/workflows/post-prod-e2e.yml
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/prod-authentik-ops.yml b/.github/workflows/prod-authentik-ops.yml
index 74e88630..c2ad2a6e 100644
--- a/.github/workflows/prod-authentik-ops.yml
+++ b/.github/workflows/prod-authentik-ops.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Authentik ops
         env:
diff --git a/.github/workflows/prod-federation-probe.yml b/.github/workflows/prod-federation-probe.yml
index 15e6219a..2cac5724 100644
--- a/.github/workflows/prod-federation-probe.yml
+++ b/.github/workflows/prod-federation-probe.yml
@@ -54,7 +54,7 @@ jobs:
     name: probe federated remotes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/prod-post-deploy.yml b/.github/workflows/prod-post-deploy.yml
index f1d3c77d..0ed86df0 100644
--- a/.github/workflows/prod-post-deploy.yml
+++ b/.github/workflows/prod-post-deploy.yml
@@ -136,7 +136,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Self-test the comparator
         run: ./deploy/scripts/check-authentik-live-boundary.sh --self-test
       - name: Probe forbidden Authentik paths on the public edge
diff --git a/.github/workflows/publish-expert.yml b/.github/workflows/publish-expert.yml
index bbeea6fd..e57c3a1a 100644
--- a/.github/workflows/publish-expert.yml
+++ b/.github/workflows/publish-expert.yml
@@ -31,7 +31,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Guard — token + manifest present
         id: guard
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 7ffa2f9f..172439b6 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -83,7 +83,7 @@ jobs:
       - name: Checkout
         # Pinned to an immutable commit SHA (repo hardening standard -- a mutable
         # tag can be silently repointed by the action owner).
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python ${{ inputs.python-version }}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4c2c7475..aa78732f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,7 +70,7 @@ jobs:
       packages: write # push to GHCR
       actions: write # dispatch prod-post-deploy.yml (see the final step)
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/rotate-sealed-secret.yml b/.github/workflows/rotate-sealed-secret.yml
index e5f4051d..a1499454 100644
--- a/.github/workflows/rotate-sealed-secret.yml
+++ b/.github/workflows/rotate-sealed-secret.yml
@@ -70,7 +70,7 @@ jobs:
   rotate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Validate inputs
         env:
diff --git a/.github/workflows/seal-consumer-secret.yml b/.github/workflows/seal-consumer-secret.yml
index fd95aad0..dea2525e 100644
--- a/.github/workflows/seal-consumer-secret.yml
+++ b/.github/workflows/seal-consumer-secret.yml
@@ -39,7 +39,7 @@ jobs:
   seal:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/seal-sms-secrets.yml b/.github/workflows/seal-sms-secrets.yml
index 257cdb9f..7f2739f7 100644
--- a/.github/workflows/seal-sms-secrets.yml
+++ b/.github/workflows/seal-sms-secrets.yml
@@ -75,7 +75,7 @@ jobs:
   seal:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 30f49726..a58eb974 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
@@ -52,7 +52,7 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Dependency Review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js 24
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -160,7 +160,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
@@ -244,7 +244,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -264,7 +264,7 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js 24
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -314,7 +314,7 @@ jobs:
 
       - name: Checkout code
         if: steps.snyk-token.outputs.present == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
         if: steps.snyk-token.outputs.present == 'true'
diff --git a/.github/workflows/service-auth-publish.yml b/.github/workflows/service-auth-publish.yml
index 25a1d84f..ef1b3152 100644
--- a/.github/workflows/service-auth-publish.yml
+++ b/.github/workflows/service-auth-publish.yml
@@ -80,7 +80,7 @@ jobs:
     if: github.repository_owner == 'izzywdev'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
diff --git a/.github/workflows/service-auth-py-publish.yml b/.github/workflows/service-auth-py-publish.yml
index 9bd62bdc..8f278f69 100644
--- a/.github/workflows/service-auth-py-publish.yml
+++ b/.github/workflows/service-auth-py-publish.yml
@@ -36,7 +36,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-python@v7
         with: { python-version: '3.12' }
diff --git a/.github/workflows/shopify-nav-apk.yml b/.github/workflows/shopify-nav-apk.yml
index 9ac8e21b..dad79a90 100644
--- a/.github/workflows/shopify-nav-apk.yml
+++ b/.github/workflows/shopify-nav-apk.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check signing secrets
         id: secrets
diff --git a/.github/workflows/workspace-deps-check.yml b/.github/workflows/workspace-deps-check.yml
index af09aaab..23fa4bc0 100644
--- a/.github/workflows/workspace-deps-check.yml
+++ b/.github/workflows/workspace-deps-check.yml
@@ -32,7 +32,7 @@ jobs:
     name: In-repo packages resolve from source
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24.x'