diff --git a/.github/workflows/book-build.yml b/.github/workflows/book-build.yml
index 0a2fe47..ae1c590 100644
--- a/.github/workflows/book-build.yml
+++ b/.github/workflows/book-build.yml
@@ -32,7 +32,7 @@ jobs:
       lines: ${{ steps.check.outputs.lines }}
       has_book: ${{ steps.check.outputs.has_book }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check book source
         id: check
@@ -56,7 +56,7 @@ jobs:
     outputs:
       pdf_name: ${{ steps.meta.outputs.pdf_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install pandoc & LaTeX
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 666c22d..6de9281 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
         # as on POSIX runners. Other OSes use the default bash.
         shell: ${{ matrix.os == 'windows-latest' && 'msys2 {0}' || 'bash' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up MSYS2 (windows only)
         if: matrix.os == 'windows-latest'
@@ -103,7 +103,7 @@ jobs:
     name: ubuntu / aarch64 / qemu
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install cross toolchain and qemu
         run: |
@@ -128,7 +128,7 @@ jobs:
     name: ubuntu / clang / asan + ubsan + leaksan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install clang
         run: |
@@ -148,7 +148,7 @@ jobs:
     name: ubuntu / determinism (3-iteration bit-identical)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build
         run: make BUILD=release lib
@@ -160,7 +160,7 @@ jobs:
     name: ubuntu / clang / libfuzzer + asan (eosm reader, 30s)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install clang
         run: |
@@ -188,7 +188,7 @@ jobs:
     name: ubuntu / clang / libfuzzer + asan (gguf reader, 30s)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install clang
         run: |
@@ -216,7 +216,7 @@ jobs:
     name: ubuntu / matmul microbenchmark (perf snapshot)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build + run benchmark
         run: make benchmark
@@ -235,7 +235,7 @@ jobs:
     name: ubuntu / static checks (error uniqueness + include firewall)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: make check-errors
         run: make check-errors
       - name: make check-includes
@@ -246,7 +246,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'schedule' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install clang (for sanitize chain)
         run: |
           sudo apt-get update
@@ -260,7 +260,7 @@ jobs:
     name: ubuntu / cli lifecycle smoke (synthetic GGUF)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install clang (for sanitize-cli)
         run: |
@@ -294,7 +294,7 @@ jobs:
     name: ubuntu / eosllm-server lifecycle smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Build server
         run: make BUILD=release server
       - name: make server-smoke
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9be71ae..2f2bd8f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
     name: Analyze (C/C++)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install build dependencies
         run: |
           sudo apt-get update
diff --git a/.github/workflows/release-browser-extension.yml b/.github/workflows/release-browser-extension.yml
index 5b681cb..981c40b 100644
--- a/.github/workflows/release-browser-extension.yml
+++ b/.github/workflows/release-browser-extension.yml
@@ -27,7 +27,7 @@ jobs:
       run:
         working-directory: browser-extension
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
diff --git a/.github/workflows/release-vscode-extension.yml b/.github/workflows/release-vscode-extension.yml
index 7e5169b..54af6e6 100644
--- a/.github/workflows/release-vscode-extension.yml
+++ b/.github/workflows/release-vscode-extension.yml
@@ -27,7 +27,7 @@ jobs:
       run:
         working-directory: vscode-extension
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55b0231..5789f8b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,7 +43,7 @@ jobs:
     outputs:
       version: ${{ steps.v.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Resolve version
@@ -65,7 +65,7 @@ jobs:
     needs: resolve-version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install clang (for sanitize chain)
         run: sudo apt-get update && sudo apt-get install -y clang
       - name: make all-checks
@@ -108,7 +108,7 @@ jobs:
     needs: resolve-version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install cross toolchain and qemu
         run: |
           sudo apt-get update
@@ -156,7 +156,7 @@ jobs:
     needs: resolve-version
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Build (arm64 + x86_64 → lipo)
         run: |
           v="${{ needs.resolve-version.outputs.version }}"
@@ -201,7 +201,7 @@ jobs:
       run:
         shell: msys2 {0}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: msys2/setup-msys2@v2
         with:
           msystem: MINGW64
@@ -263,7 +263,7 @@ jobs:
     needs: resolve-version
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Configure (cmake, ARM64)
         shell: pwsh
         run: |
@@ -287,7 +287,7 @@ jobs:
     needs: resolve-version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install cross toolchain and qemu
         run: |
           sudo apt-get update
@@ -326,7 +326,7 @@ jobs:
     needs: resolve-version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: git archive
@@ -367,7 +367,7 @@ jobs:
       - build-source-tarball
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/download-artifact@v4
         with:
           path: artifacts
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c784f31..a6ee1bb 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/sync-release-branch.yml b/.github/workflows/sync-release-branch.yml
index dd27bdd..2296033 100644
--- a/.github/workflows/sync-release-branch.yml
+++ b/.github/workflows/sync-release-branch.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout tagged commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
           ref: ${{ github.ref }}
diff --git a/.github/workflows/video-build.yml b/.github/workflows/video-build.yml
index a5e105d..d75f083 100644
--- a/.github/workflows/video-build.yml
+++ b/.github/workflows/video-build.yml
@@ -21,7 +21,7 @@ jobs:
     name: Render Promo Video
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Detect promo sources
         id: detect