diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9cb76abe..dccba43c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout first to use locally defined actions
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: ./.github/setup-nix
@@ -68,7 +68,7 @@ jobs:
     runs-on: [self-hosted, linux, x64]
     steps:
       - name: Checkout first to use locally defined actions
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Stage the devShell test fixture as the workspace flake
         run: |
@@ -148,7 +148,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout first to use locally defined actions
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       # On this runner Nix already exists, so the installer step is skipped and
       # only `Configure Nix` + the new verification run. A green step here is
@@ -190,7 +190,7 @@ jobs:
     runs-on: [self-hosted, linux, x64]
     steps:
       - name: Checkout first to use locally defined actions
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: ./.github/setup-nix
@@ -259,7 +259,7 @@ jobs:
     runs-on: [self-hosted, linux, x64]
     steps:
       - name: Checkout first to use locally defined actions
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: ./.github/setup-nix
diff --git a/.github/workflows/netbird-attic-smoke.yml b/.github/workflows/netbird-attic-smoke.yml
index ddeea45b..b926cbdd 100644
--- a/.github/workflows/netbird-attic-smoke.yml
+++ b/.github/workflows/netbird-attic-smoke.yml
@@ -16,7 +16,7 @@ jobs:
       ATTIC_SUBSTITUTER: https://cache.metacraft-labs.com/metacraft-private-infrastructure
       ATTIC_TRUSTED_PUBLIC_KEY: metacraft-private-infrastructure:TWjFAlGXK9Mky5VG3PBln2MqYz4XPw3MTHHVPYZiAhE=
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
 
       # No netbird-cache-probe-url: the private cache returns 401 without a
       # token, and the probe uses `curl -fsS` (fails on 4xx). Connectivity is
diff --git a/.github/workflows/reusable-cloudflare-import.yml b/.github/workflows/reusable-cloudflare-import.yml
index 25286a21..7954e24f 100644
--- a/.github/workflows/reusable-cloudflare-import.yml
+++ b/.github/workflows/reusable-cloudflare-import.yml
@@ -86,8 +86,8 @@ jobs:
   offline:
     runs-on: ${{ fromJSON(inputs.runner) }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: metacraft-labs/devops-modules
           ref: ${{ inputs.nixos_modules_ref }}
@@ -145,8 +145,8 @@ jobs:
       || (github.event_name == 'workflow_dispatch' && inputs.mode == 'plan')
     runs-on: ${{ fromJSON(inputs.runner) }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: metacraft-labs/devops-modules
           ref: ${{ inputs.nixos_modules_ref }}
@@ -195,7 +195,7 @@ jobs:
           echo "token_path=$token_file" >> "$GITHUB_OUTPUT"
 
       - name: Configure AWS credentials for plan
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ github.event_name == 'workflow_dispatch' && vars.AWS_TERRAFORM_DRIFT_ROLE_ARN || vars.AWS_TERRAFORM_PLAN_ROLE_ARN }}
@@ -309,8 +309,8 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runner) }}
     environment: production
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: metacraft-labs/devops-modules
           ref: ${{ inputs.nixos_modules_ref }}
@@ -355,7 +355,7 @@ jobs:
           echo "token_path=$token_file" >> "$GITHUB_OUTPUT"
 
       - name: Configure AWS credentials for apply
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ vars.AWS_TERRAFORM_APPLY_ROLE_ARN }}
diff --git a/.github/workflows/reusable-flake-checks-ci-matrix.yml b/.github/workflows/reusable-flake-checks-ci-matrix.yml
index b9b900fb..b87cfaf8 100644
--- a/.github/workflows/reusable-flake-checks-ci-matrix.yml
+++ b/.github/workflows/reusable-flake-checks-ci-matrix.yml
@@ -244,7 +244,7 @@ jobs:
           grep -q "^machine $h " "$HOME/.config/nix/netrc" 2>/dev/null || \
             printf 'machine %s password %s\n' "$h" "$ATTIC_TOKEN" >> "$HOME/.config/nix/netrc"
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
 
       - name: Generate Shard Matrix
         id: generate-matrix
@@ -311,7 +311,7 @@ jobs:
           grep -q "^machine $h " "$HOME/.config/nix/netrc" 2>/dev/null || \
             printf 'machine %s password %s\n' "$h" "$ATTIC_TOKEN" >> "$HOME/.config/nix/netrc"
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
 
       - name: Generate CI Matrix
         id: generate-matrix
@@ -352,7 +352,7 @@ jobs:
     if: needs.shard-matrix.outputs.eval_matrix != '{"include":[]}' &&
       needs.eval-matrix.result == 'success'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: metacraft-labs/devops-modules/.github/setup-nix@dev
@@ -763,7 +763,7 @@ jobs:
         run: |
           echo "All evaluated outputs were already present in the configured caches."
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         if: ${{ !matrix.noop }}
 
       - name: Setup Nix
diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml
index 1ec38ab6..a4438581 100644
--- a/.github/workflows/reusable-lint.yml
+++ b/.github/workflows/reusable-lint.yml
@@ -148,7 +148,7 @@ jobs:
       LINT_HAS_STATIC_TOKEN: ${{ secrets.NIX_GITHUB_TOKEN != '' || secrets.GH_READ_METACRAFT_PRIVATE_REPOS != '' }}
       LINT_HAS_TOKEN_APP: ${{ secrets.CI_TOKEN_PROVIDER_PRIVATE_KEY != '' && (secrets.CI_TOKEN_PROVIDER_APP_ID != '' || vars.CI_TOKEN_PROVIDER_APP_ID != '') }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
 
diff --git a/.github/workflows/reusable-merge.yml b/.github/workflows/reusable-merge.yml
index 15a9ffb6..2e09f355 100644
--- a/.github/workflows/reusable-merge.yml
+++ b/.github/workflows/reusable-merge.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runner) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/reusable-nix-diff.yml b/.github/workflows/reusable-nix-diff.yml
index 70cc8461..4e515676 100644
--- a/.github/workflows/reusable-nix-diff.yml
+++ b/.github/workflows/reusable-nix-diff.yml
@@ -42,7 +42,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -204,7 +204,7 @@ jobs:
         id: nix-diff-full
         if: steps.discover.outputs.count != '0'
         continue-on-error: true
-        uses: natsukium/nix-diff-action@v1.1.0
+        uses: natsukium/nix-diff-action@v1.1.1
         env:
           NIX_CONFIG: |
             experimental-features = nix-command flakes pipe-operators
@@ -218,7 +218,7 @@ jobs:
         id: nix-diff-fallback
         if: steps.nix-diff-full.outcome == 'failure'
         continue-on-error: true
-        uses: natsukium/nix-diff-action@v1.1.0
+        uses: natsukium/nix-diff-action@v1.1.1
         env:
           NIX_CONFIG: |
             experimental-features = nix-command flakes pipe-operators
diff --git a/.github/workflows/reusable-public-runner-guard.yml b/.github/workflows/reusable-public-runner-guard.yml
index fb297f94..14797593 100644
--- a/.github/workflows/reusable-public-runner-guard.yml
+++ b/.github/workflows/reusable-public-runner-guard.yml
@@ -32,9 +32,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout caller repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
       - name: Checkout nixos-modules (checker source)
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
         with:
           repository: metacraft-labs/devops-modules
           ref: ${{ inputs.ref }}
diff --git a/.github/workflows/reusable-recorder-ci.yml b/.github/workflows/reusable-recorder-ci.yml
index fe22a50c..a39903c8 100644
--- a/.github/workflows/reusable-recorder-ci.yml
+++ b/.github/workflows/reusable-recorder-ci.yml
@@ -63,11 +63,11 @@ jobs:
         runner: ${{ fromJSON(inputs.runners) }}
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Generate CI token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.CI_TOKEN_PROVIDER_APP_ID }}
           private-key: ${{ secrets.CI_TOKEN_PROVIDER_PRIVATE_KEY }}
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-logs-${{ join(matrix.runner, '-') }}
           path: ${{ inputs.log-path }}
diff --git a/.github/workflows/reusable-terraform-ci.yml b/.github/workflows/reusable-terraform-ci.yml
index e1371028..c1475f7e 100644
--- a/.github/workflows/reusable-terraform-ci.yml
+++ b/.github/workflows/reusable-terraform-ci.yml
@@ -266,10 +266,10 @@ jobs:
       TF_DEVSHELL_FLAKE_REQUESTED: ${{ vars.TERRAFORM_DEVSHELL_FLAKE }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout called workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -517,10 +517,10 @@ jobs:
       TF_DEVSHELL_FLAKE_REQUESTED: ${{ vars.TERRAFORM_DEVSHELL_FLAKE }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout called workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -691,7 +691,7 @@ jobs:
       - name: Mint GitHub App token
         if: inputs.github_app_owner != ''
         id: gh_app_token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v2
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -717,7 +717,7 @@ jobs:
 
       - name: Configure AWS credentials for plan
         if: inputs.aws_plan_role_arn != ''
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ inputs.aws_plan_role_arn }}
@@ -1144,10 +1144,10 @@ jobs:
     environment: ${{ inputs.environment_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout called workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -1321,7 +1321,7 @@ jobs:
       - name: Mint GitHub App token
         if: inputs.github_app_owner != ''
         id: gh_app_token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v2
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -1347,7 +1347,7 @@ jobs:
 
       - name: Configure AWS credentials for apply
         if: inputs.aws_apply_role_arn != ''
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ inputs.aws_apply_role_arn }}
@@ -1515,7 +1515,7 @@ jobs:
       - name: Re-mint GitHub App token for apply
         if: steps.apply_plan.outputs.changes == 'true' && inputs.github_app_owner != ''
         id: gh_app_token_apply
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v2
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -1529,7 +1529,7 @@ jobs:
 
       - name: Refresh AWS credentials for apply
         if: steps.apply_plan.outputs.changes == 'true' && inputs.aws_apply_role_arn != ''
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ inputs.aws_apply_role_arn }}
@@ -1618,10 +1618,10 @@ jobs:
       TF_DEVSHELL_FLAKE_REQUESTED: ${{ vars.TERRAFORM_DEVSHELL_FLAKE }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout called workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -1788,7 +1788,7 @@ jobs:
       - name: Mint GitHub App token
         if: inputs.github_app_owner != ''
         id: gh_app_token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v2
         with:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
@@ -1802,7 +1802,7 @@ jobs:
 
       - name: Configure AWS credentials for drift
         if: inputs.aws_plan_role_arn != '' || inputs.aws_drift_role_arn != ''
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           aws-region: ${{ inputs.aws_region }}
           role-to-assume: ${{ inputs.aws_drift_role_arn != '' && inputs.aws_drift_role_arn || inputs.aws_plan_role_arn }}
diff --git a/.github/workflows/reusable-update-flake-lock.yml b/.github/workflows/reusable-update-flake-lock.yml
index 641c0ac1..4436ad44 100644
--- a/.github/workflows/reusable-update-flake-lock.yml
+++ b/.github/workflows/reusable-update-flake-lock.yml
@@ -65,7 +65,7 @@ jobs:
       pull-request-number: ${{ steps.create-pr.outputs.pull-request-number }}
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: metacraft-labs/devops-modules/.github/setup-nix@dev
diff --git a/.github/workflows/reusable-update-flake-packages.yml b/.github/workflows/reusable-update-flake-packages.yml
index 983532d8..8ae0eaa6 100644
--- a/.github/workflows/reusable-update-flake-packages.yml
+++ b/.github/workflows/reusable-update-flake-packages.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runner || '["self-hosted", "linux", "x64"]') }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Setup Nix
         uses: metacraft-labs/devops-modules/.github/setup-nix@dev
diff --git a/.github/workflows/setup-nix-netrc.yml b/.github/workflows/setup-nix-netrc.yml
index 68ddd15e..6c3f4506 100644
--- a/.github/workflows/setup-nix-netrc.yml
+++ b/.github/workflows/setup-nix-netrc.yml
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       # What the file MAKES CURL SEND, which is a different claim from what the
       # file contains -- and the only one that can see the defect this guards.
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Setup Nix (this action, defaults)
         uses: ./.github/setup-nix