diff --git a/.github/workflows/blog-release.yml b/.github/workflows/blog-release.yml
index 1f0909c..c76f537 100644
--- a/.github/workflows/blog-release.yml
+++ b/.github/workflows/blog-release.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b66056d..55c0589 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
     name: Lint (ruff)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -35,7 +35,7 @@ jobs:
     name: Type check (mypy)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -56,7 +56,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -94,7 +94,7 @@ jobs:
     name: Smoke test (CLI --scan-only)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -125,7 +125,7 @@ jobs:
     name: Extensions — iac-scanner-cdk-nag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -164,7 +164,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint, test, smoke, test-extensions]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # setuptools-scm needs the full git history to derive the version.
           fetch-depth: 0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f4ba457..8b63287 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
         language: ["python"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 1269e07..2117c76 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -25,7 +25,7 @@ jobs:
     name: Sync from labels.yml
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Apply label config
         uses: EndBug/label-sync@v2
diff --git a/.github/workflows/nightly-e2e.yml b/.github/workflows/nightly-e2e.yml
index 0be5083..af1c13c 100644
--- a/.github/workflows/nightly-e2e.yml
+++ b/.github/workflows/nightly-e2e.yml
@@ -32,7 +32,7 @@ jobs:
       # Disable response cache so E2E genuinely hits the LLM
       IAC_NO_CACHE: "1"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
diff --git a/.github/workflows/publish-nag-pypi.yml b/.github/workflows/publish-nag-pypi.yml
index eab6dc9..88817f8 100644
--- a/.github/workflows/publish-nag-pypi.yml
+++ b/.github/workflows/publish-nag-pypi.yml
@@ -43,7 +43,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -65,7 +65,7 @@ jobs:
     needs: [test]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 0291bf0..7eb3b2f 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -19,7 +19,7 @@ jobs:
     name: Build distributions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # setuptools-scm derives the version from git tags. Without full
           # history (and unshallowed fetch), it falls back to fallback_version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6e39dc0..31169c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: write   # required to create the Release
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # need full history so the tag annotation is reachable
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7ed1a3c..81013a3 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,7 +31,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b94aae3..2e4c695 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -22,7 +22,7 @@ jobs:
     name: SAST (bandit, ruff-S)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -40,7 +40,7 @@ jobs:
     name: Dependency audit (pip-audit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6
@@ -60,7 +60,7 @@ jobs:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history so gitleaks can scan all commits, not just the HEAD
           fetch-depth: 0
@@ -78,7 +78,7 @@ jobs:
     name: Self-scan (iac-scan on samples)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # setuptools-scm needs git history to derive the package version
       - uses: actions/setup-python@v6