diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3fcb2311..306962b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -72,13 +72,13 @@ jobs:
       TRANSFORMERS_OFFLINE: "1"
       HF_HUB_OFFLINE: "1"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
           enable-cache: true
       - name: Cache HuggingFace models (BAAI/bge-small-en-v1.5)
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/huggingface
           key: hf-models-bge-small-en-v1.5-${{ runner.os }}
diff --git a/.github/workflows/epic-validation.yml b/.github/workflows/epic-validation.yml
index 4d5ad8a8..0b7c0c9e 100644
--- a/.github/workflows/epic-validation.yml
+++ b/.github/workflows/epic-validation.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Validate EPIC-059 – EPIC-063 frontmatter
         run: |
diff --git a/.github/workflows/hive-smoke.yml b/.github/workflows/hive-smoke.yml
index 4ecf91eb..5f9da323 100644
--- a/.github/workflows/hive-smoke.yml
+++ b/.github/workflows/hive-smoke.yml
@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0d025460..76c5f4f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
       tag: ${{ steps.meta.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # On a tag push GITHUB_REF is refs/tags/vX.Y.Z, so checkout grabs
           # the tag — this is the explicit guarantee that we never build a
@@ -111,7 +111,7 @@ jobs:
     permissions:
       contents: write   # gh release create
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.tag || github.ref }}
       - uses: actions/download-artifact@v8
diff --git a/.github/workflows/ts-sdk.yml b/.github/workflows/ts-sdk.yml
index ad1cb6e1..cf21cb90 100644
--- a/.github/workflows/ts-sdk.yml
+++ b/.github/workflows/ts-sdk.yml
@@ -30,7 +30,7 @@ jobs:
         working-directory: packages/${{ matrix.package }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -81,7 +81,7 @@ jobs:
           --health-retries 10
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -150,7 +150,7 @@ jobs:
         working-directory: packages/${{ matrix.package }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js with npm registry
         uses: actions/setup-node@v6