diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 79c9c03..cbcd7fe 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,12 +9,12 @@ updates:
     schedule:
       interval: weekly
     # An explicit labels: list replaces (not adds to) Dependabot's automatic
-    # labels, so the ecosystem-derived default is restated alongside
-    # dependencies.
+    # labels. Only `dependencies` is listed: the ecosystem default
+    # `github_actions` is not in this org's github-iac label roster, and
+    # Dependabot fails the apply with "label could not be found".
     # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#labels
     labels:
       - dependencies
-      - github_actions
     # `ci-status` fails a pull request whose title is not Conventional Commits,
     # and Dependabot's default title carries no type, so the prefix is
     # required rather than cosmetic.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74bad4a..c83d7e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,9 +91,9 @@ jobs:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
     runs-on: ubuntu-latest
     steps:
-      # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this
+      # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this
       # org requires it; a tag or short SHA is rejected at "Set up job".
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Install shellcheck
         run: sudo apt-get update && sudo apt-get install -y shellcheck
@@ -115,9 +115,9 @@ jobs:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
     runs-on: ubuntu-latest
     steps:
-      # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this
+      # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this
       # org requires it; a tag or short SHA is rejected at "Set up job".
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Install PSScriptAnalyzer
         shell: pwsh
@@ -149,9 +149,9 @@ jobs:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
     runs-on: ubuntu-latest
     steps:
-      # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this
+      # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this
       # org requires it; a tag or short SHA is rejected at "Set up job".
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: jq — manifests are well-formed JSON
         run: |
@@ -195,9 +195,9 @@ jobs:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
     runs-on: ubuntu-latest
     steps:
-      # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this
+      # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this
       # org requires it; a tag or short SHA is rejected at "Set up job".
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       # Relative links only. External URLs are deliberately NOT checked here:
       # GitHub and cursor.directory return 403/429 to CI runners, which would