diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 71d6a0f8..7c0cf4d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10    # obs max 23s; fmt --check, no build
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           components: rustfmt
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # obs max 117s; cold --all-features cargo check is the unknown
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       # --all-features is REQUIRED: the R8 memory tests read lb-l7's
       # `#[cfg(feature = "test-gauges")]` gauges, which are off by default.
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # obs max 120s; same build shape as `check`
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           components: clippy
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10    # obs max 10s; pure grep, no toolchain
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Verify panic-freedom deny lints are present in every library crate
         run: |
           MISSING=""
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15    # obs max 9s; fetch-depth:0 + tier-2 SHA walk grows with history
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Tier-2 walks historical SHAs — needs full history.
           fetch-depth: 0
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90    # obs max 1251s; MUST exceed the 45+25 step caps below
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       # The --all-features test build links many large integration binaries and
       # hits ENOSPC on a hosted runner with a warm cache. Frees ~15-20 GB; no
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # obs max 115s; separate toolchain => colder cache
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45    # obs max 293s; cargo-fuzz is built from source
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: nightly
@@ -191,7 +191,7 @@ jobs:
     timeout-minutes: 45    # obs max 239s; MUST exceed the 30 step cap below
     needs: [check, clippy, test, fmt, panic-freedom, doc-lint]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       - run: cargo build --workspace --release
         timeout-minutes: 30
@@ -202,7 +202,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # obs max 199s; cargo-audit is built from source
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # +stable: cargo-audit needs a newer rustc than rust-toolchain.toml's pin.
       - uses: ./.github/actions/rust-setup
       - name: Install cargo-audit
@@ -218,7 +218,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15    # obs max 26s; prebuilt musl binary, no compile
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install cargo-deny (prebuilt binary)
         run: |
           VER=0.19.6
@@ -236,7 +236,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 50    # obs max 846s. CF-S44 job. Sits ABOVE nextest global-timeout=40m
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -307,7 +307,7 @@ jobs:
       H2SPEC_VER: "v2.6.0"
       H3SPEC_VER: "v0.1.13"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -395,7 +395,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # obs max 209s; slowloris cases are wall-clock bound
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -426,7 +426,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45    # obs max 362s; docker build has no rust-cache + Trivy DB fetch
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build image
         run: |
           docker build -f docker/Dockerfile \
@@ -453,7 +453,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20    # obs max 47s; one test binary + a privileged BPF_PROG_LOAD
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0d0ddcaa..b61628b3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,9 +48,9 @@ jobs:
       id-token: write          # GitHub OIDC -> assume the soak IAM role
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Configure AWS credentials (OIDC, scoped role)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.SOAK_AWS_ROLE_ARN }}
           aws-region: ${{ vars.SOAK_REGION }}
@@ -90,7 +90,7 @@ jobs:
             os: ubuntu-latest
             artifact: expressgateway-linux-arm64
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -125,7 +125,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Login to GHCR
@@ -164,7 +164,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Download artifacts
         uses: actions/download-artifact@v8
       - name: Create GitHub Release
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index e2b0c3fe..80bfbfbe 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # mirrors ci.yml `audit`; obs max 199s there
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       - name: Install cargo-audit
         run: cargo +stable install cargo-audit --locked
@@ -39,7 +39,7 @@ jobs:
     timeout-minutes: 60    # builds cargo-geiger from source + a full --all-features scan
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       - name: Install cargo-geiger
         run: cargo +stable install cargo-geiger --locked
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30    # cache:'false' => always a cold source install
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           cache: 'false'