diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6352255a..2cfa376d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           components: rustfmt
@@ -45,7 +45,7 @@ jobs:
     name: Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       # --all-features is REQUIRED: the R8 memory tests read lb-l7's
       # `#[cfg(feature = "test-gauges")]` gauges, which are off by default.
@@ -55,7 +55,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           components: clippy
@@ -65,7 +65,7 @@ jobs:
     name: Panic Freedom Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Verify panic-freedom deny lints are present in every library crate
         run: |
           MISSING=""
@@ -87,7 +87,7 @@ jobs:
     name: Doc Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Tier-2 walks historical SHAs — needs full history.
           fetch-depth: 0
@@ -98,7 +98,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       # The --all-features test build links many large integration binaries and
       # hits ENOSPC on a hosted runner with a warm cache. Frees ~15-20 GB; no
@@ -136,7 +136,7 @@ jobs:
     name: MSRV (1.88)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -146,7 +146,7 @@ jobs:
     name: Fuzz Smoke Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: nightly
@@ -174,7 +174,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [check, clippy, test, fmt, panic-freedom, doc-lint]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       - run: cargo build --workspace --release
         timeout-minutes: 30
@@ -184,7 +184,7 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # +stable: cargo-audit needs a newer rustc than rust-toolchain.toml's pin.
       - uses: ./.github/actions/rust-setup
       - name: Install cargo-audit
@@ -199,7 +199,7 @@ jobs:
     name: cargo-deny (licenses/advisories/bans/sources)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install cargo-deny (prebuilt binary)
         run: |
           VER=0.19.6
@@ -216,7 +216,7 @@ jobs:
     name: Coverage (per-module hot-path >= 80%)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -251,7 +251,7 @@ jobs:
       H2SPEC_VER: "v2.6.0"
       H3SPEC_VER: "v0.1.13"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -338,7 +338,7 @@ jobs:
     name: Chaos Attack Suite
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
@@ -361,7 +361,7 @@ jobs:
     name: Container Image (build + serve smoke + trivy)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build image
         run: |
           docker build -f docker/Dockerfile \
@@ -387,7 +387,7 @@ jobs:
     name: XDP Verifier Smoke (runner kernel)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.RUST_MSRV }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ca199424..3370589c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,9 +37,9 @@ jobs:
       id-token: write          # GitHub OIDC -> assume the soak IAM role
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Configure AWS credentials (OIDC, scoped role)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.SOAK_AWS_ROLE_ARN }}
           aws-region: ${{ vars.SOAK_REGION }}
@@ -78,7 +78,7 @@ jobs:
             os: ubuntu-latest
             artifact: expressgateway-linux-arm64
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -112,7 +112,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Login to GHCR
@@ -150,7 +150,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Download artifacts
         uses: actions/download-artifact@v8
       - name: Create GitHub Release
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index bedd44f3..894a78c5 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -23,7 +23,7 @@ jobs:
     name: Dependency Audit (weekly, strict)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       - name: Install cargo-audit
         run: cargo +stable install cargo-audit --locked
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
       - name: Install cargo-geiger
         run: cargo +stable install cargo-geiger --locked
@@ -58,7 +58,7 @@ jobs:
     name: Unused Deps (cargo-machete)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/rust-setup
         with:
           cache: 'false'