diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7cd52e466..eaf1f661c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
         language: [javascript-typescript]
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0c90c768a..8820b0fab 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -23,7 +23,7 @@ jobs:
       packages: write
     steps:
       # QNBS-v3: SHA-pinned to prevent supply-chain attacks via mutable tags
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 5924ca599..5fa3a32a1 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -63,7 +63,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6b619c9df..db7ad3005 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -23,7 +23,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/storybook-debug.yml b/.github/workflows/storybook-debug.yml
index cfbfb832b..966071a38 100644
--- a/.github/workflows/storybook-debug.yml
+++ b/.github/workflows/storybook-debug.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 35
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index ba8aa6aa8..9b427dbe3 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -37,7 +37,7 @@ jobs:
           - os: macos-latest
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # QNBS-v3: composite action handles pnpm/node setup + frozen install.
diff --git a/.github/workflows/voice-nightly.yml b/.github/workflows/voice-nightly.yml
index d801b0977..7ee1b55b7 100644
--- a/.github/workflows/voice-nightly.yml
+++ b/.github/workflows/voice-nightly.yml
@@ -25,7 +25,7 @@ jobs:
     # Never gate anything — informational nightly signal only.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup