diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b50d544..3169c20 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     name: Preflight (ubuntu)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -58,7 +58,7 @@ jobs:
     name: Preflight (windows -- PSScriptAnalyzer)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -82,7 +82,7 @@ jobs:
     name: check-all.sh
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pin Node 22.x (matches the other jobs). Without this, check-all ran on the
       # runner's default Node, where node:sqlite is unavailable/partial and the
       # mcp-server suite failed ~129 sqlite-backed tests.
@@ -102,7 +102,7 @@ jobs:
     name: Plugin manifest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate plugin manifest JSON
         run: node -e "JSON.parse(require('fs').readFileSync('claude/.claude-plugin/plugin.json','utf8'))"
       - name: Required plugin manifest fields
@@ -119,7 +119,7 @@ jobs:
     env:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3b27f8b..eb52ae1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,7 +13,7 @@ jobs:
     name: Preflight gate (belt-and-braces)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -61,7 +61,7 @@ jobs:
     name: check-all.sh (release gate)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Node 22.x: node:sqlite is unavailable/partial on the runner default.
       - uses: actions/setup-node@v6
         with:
@@ -88,7 +88,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Node 24.x ships npm 11.x natively, which is the version that supports
       # Trusted Publishing OIDC token exchange. Avoids the known in-place
@@ -221,7 +221,7 @@ jobs:
       contents: read
     # 1.2.1's first run was green; gating this job from 1.2.2 onward.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install git inside container
         run: |
diff --git a/.github/workflows/refresh-prices.yml b/.github/workflows/refresh-prices.yml
index b9e5bac..174746d 100644
--- a/.github/workflows/refresh-prices.yml
+++ b/.github/workflows/refresh-prices.yml
@@ -13,7 +13,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Fetch and filter LiteLLM prices
         run: |
diff --git a/.github/workflows/windows-smoke.yml b/.github/workflows/windows-smoke.yml
index d9a9716..e22cf08 100644
--- a/.github/workflows/windows-smoke.yml
+++ b/.github/workflows/windows-smoke.yml
@@ -18,7 +18,7 @@ jobs:
       matrix:
         mode: [default-path, stripped-path]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with: