diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7bb28e5..35ec552 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     name: dbt syntax check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -39,7 +39,7 @@ jobs:
     name: Dart AOT build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v3
 
@@ -68,7 +68,7 @@ jobs:
     name: Python lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5ba9a73..a8830c4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL (Python)
         uses: github/codeql-action/init@v3
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0cd1060..abb8bb1 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -14,7 +14,7 @@ jobs:
     name: Lint & Format
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -60,7 +60,7 @@ jobs:
       POSTGRES_PORT:     "5432"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -111,7 +111,7 @@ jobs:
       POSTGRES_PORT:     "5432"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v5
         with:
@@ -142,7 +142,7 @@ jobs:
     continue-on-error: true  # skip gracefully when EC2 secrets are not configured
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Deploy via SSH
         uses: appleboy/ssh-action@v1.0.3
diff --git a/.github/workflows/pipeline_v2.yml b/.github/workflows/pipeline_v2.yml
index d1e57c8..569c0cc 100644
--- a/.github/workflows/pipeline_v2.yml
+++ b/.github/workflows/pipeline_v2.yml
@@ -67,7 +67,7 @@ jobs:
           --shm-size 256m
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # 'postgres' hostname resolves to localhost — all scripts/dbt work unchanged
       - name: Map 'postgres' hostname