diff --git a/.github/workflows/exercise-path.yml b/.github/workflows/exercise-path.yml
index 7a400f12..61abd347 100644
--- a/.github/workflows/exercise-path.yml
+++ b/.github/workflows/exercise-path.yml
@@ -37,7 +37,7 @@ jobs:
     name: Build quota-router-core
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Build with all features (--features full per RFC-0917 mutex)
         run: cargo build -p quota-router-core --features full
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Run 11-step exercise under --features full (per RFC-0917 mutex; litellm-mode + any-llm-mode mutually exclusive)
         run: cargo test -p quota-router-core --test eleven_step --features full
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Run body-field linter via gating egress_boundary integration tests
         # Mission 0957-b AC-1 + RFC-0957 §Adversary A5 body-leakage defense.
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Verify no new reqwest::Client::new sites outside the allowlisted egress surface
         # Mission 0957-b R4 close-out: the clippy [disallowed-methods] deny
         # has 14 module-level `#[allow(...)]` exemptions (proxy.rs + 12
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Verify attach_bearer() call count has not drifted from the checked-in baseline (36)
         # Mission 0957-b R9-6: the total number of `attach_bearer()` call
         # sites is a structural invariant — every provider egress path
@@ -107,7 +107,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -125,7 +125,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Verify goldens match (RFC-0959 v1.0 settlement_hash + receipt_id check-ins)
         run: cargo test -p quota-router-core --test goldens --features full
@@ -135,7 +135,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Run cross-impl ZK vectors (RFC-0958 §Test Vectors TV1+TV2 + RFC-0959 v1.0 settlement hash)
         run: cargo test -p quota-router-core --test zk_vectors --features full
@@ -145,7 +145,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: 8 RFC-0958 test vectors + RFC-0959 settlement hash replay defense
         # cargo-fuzz target `capability_verify` is NOT yet wired (TBD by
diff --git a/.github/workflows/zk-capability-circuit.yml b/.github/workflows/zk-capability-circuit.yml
index 1e806b82..317fef63 100644
--- a/.github/workflows/zk-capability-circuit.yml
+++ b/.github/workflows/zk-capability-circuit.yml
@@ -47,7 +47,7 @@ jobs:
     name: Build cipherocto workspace (stable rust)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install system deps
         # Same set as exercise-path.yml: libdbus-1-dev + pkg-config for
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install system deps
         run: |
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install system deps
         run: |
@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -123,7 +123,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Run layered defense linter
         # Fail-closed: any mint_with_zk call site outside the canonical
         # API file fails the build. Layered with the runtime gate
@@ -135,7 +135,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install system deps
         run: |
@@ -154,7 +154,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install system deps
         run: |
@@ -170,7 +170,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -191,7 +191,7 @@ jobs:
     # corpus on disk).
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Round 4 review F-27 (2026-08-05): `cargo fuzz run` requires the
       # nightly toolchain (uses `-Z` unstable flags). The build job uses
       # stable; this job installs nightly explicitly. Toolchain pin matches