diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index a9434ef8..a25bd3cf 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -21,7 +21,7 @@ jobs:
     name: Publish CLI
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/docfacts-impact.yml b/.github/workflows/docfacts-impact.yml
index 681b6d67..27680786 100644
--- a/.github/workflows/docfacts-impact.yml
+++ b/.github/workflows/docfacts-impact.yml
@@ -39,14 +39,14 @@ jobs:
 
       - name: Checkout PR (full history for merge-base)
         if: steps.gate.outputs.enabled == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           path: caller
 
       - name: Checkout docfacts
         if: steps.gate.outputs.enabled == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: primitivedotdev/docfacts
           token: ${{ secrets.DOCFACTS_READ_TOKEN }}
diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml
index 4c4ae3ff..866693d3 100644
--- a/.github/workflows/go-release.yml
+++ b/.github/workflows/go-release.yml
@@ -19,7 +19,7 @@ jobs:
     name: Publish Go SDK
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/mcp-release.yml b/.github/workflows/mcp-release.yml
index 91458e45..cf62e09f 100644
--- a/.github/workflows/mcp-release.yml
+++ b/.github/workflows/mcp-release.yml
@@ -21,7 +21,7 @@ jobs:
     name: Publish MCP Server
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index df152782..ecda85c3 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -21,7 +21,7 @@ jobs:
     name: Publish Node SDK
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index 3e1b514c..17657c0d 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -21,7 +21,7 @@ jobs:
     name: Publish Python SDK
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/sdk-checks.yml b/.github/workflows/sdk-checks.yml
index 703a71a6..db296e1d 100644
--- a/.github/workflows/sdk-checks.yml
+++ b/.github/workflows/sdk-checks.yml
@@ -25,7 +25,7 @@ jobs:
       go: ${{ steps.full.outputs.go || steps.filter.outputs.go }}
       shared: ${{ steps.full.outputs.shared || steps.filter.outputs.shared }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - id: full
         if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' }}
@@ -76,7 +76,7 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
         with:
@@ -116,7 +116,7 @@ jobs:
       matrix:
         node-version: [22, 24]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
         with:
@@ -156,7 +156,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.14"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990
         with:
@@ -187,7 +187,7 @@ jobs:
       matrix:
         go-version: ["1.25", "1.26"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
@@ -213,7 +213,7 @@ jobs:
     if: ${{ needs.changes.outputs.shared == 'true' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
         with: