diff --git a/.github/workflows/bazel-tests.yml b/.github/workflows/bazel-tests.yml
index e79d1fd..6c5cfa7 100644
--- a/.github/workflows/bazel-tests.yml
+++ b/.github/workflows/bazel-tests.yml
@@ -28,7 +28,7 @@ jobs:
       matrix:
         os: [ubuntu-22.04, macos-14]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -63,7 +63,7 @@ jobs:
     name: Verus-Strip Gate
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -87,7 +87,7 @@ jobs:
     name: FFI Feature Sizes
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index 0712176..ef2913f 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -40,7 +40,7 @@ jobs:
           case "$TAG" in v*) ;; *) echo "::error::tag '$TAG' must start with v"; exit 1 ;; esac
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index de51ca9..2bb69df 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -22,7 +22,7 @@ jobs:
     name: Rust Coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@nightly
       - uses: Swatinem/rust-cache@v2
 
@@ -66,7 +66,7 @@ jobs:
       GITHUB_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/engine-bench-renode-flight.yml b/.github/workflows/engine-bench-renode-flight.yml
index 9c03d73..99a10e2 100644
--- a/.github/workflows/engine-bench-renode-flight.yml
+++ b/.github/workflows/engine-bench-renode-flight.yml
@@ -56,7 +56,7 @@ jobs:
       DOCKER_CONFIG: /tmp/.docker
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/engine-bench-renode-lto.yml b/.github/workflows/engine-bench-renode-lto.yml
index d34fbec..704b4f2 100644
--- a/.github/workflows/engine-bench-renode-lto.yml
+++ b/.github/workflows/engine-bench-renode-lto.yml
@@ -51,7 +51,7 @@ jobs:
       DOCKER_CONFIG: /tmp/.docker
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/engine-bench-renode-synth.yml b/.github/workflows/engine-bench-renode-synth.yml
index 69a44f4..c445476 100644
--- a/.github/workflows/engine-bench-renode-synth.yml
+++ b/.github/workflows/engine-bench-renode-synth.yml
@@ -78,7 +78,7 @@ jobs:
       DOCKER_CONFIG: /tmp/.docker
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/engine-bench-renode.yml b/.github/workflows/engine-bench-renode.yml
index 2ac67fd..3bddd73 100644
--- a/.github/workflows/engine-bench-renode.yml
+++ b/.github/workflows/engine-bench-renode.yml
@@ -55,7 +55,7 @@ jobs:
       DOCKER_CONFIG: /tmp/.docker
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/engine-bench-smoke.yml b/.github/workflows/engine-bench-smoke.yml
index 482bcaa..92d5422 100644
--- a/.github/workflows/engine-bench-smoke.yml
+++ b/.github/workflows/engine-bench-smoke.yml
@@ -55,7 +55,7 @@ jobs:
       DOCKER_CONFIG: /tmp/.docker
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml
index de1a0c6..93b037f 100644
--- a/.github/workflows/formal-verification.yml
+++ b/.github/workflows/formal-verification.yml
@@ -44,7 +44,7 @@ jobs:
     name: Verus SMT (39 modules)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: cachix/install-nix-action@v31
 
@@ -60,7 +60,7 @@ jobs:
     name: Kani BMC (185 harnesses)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@nightly
 
@@ -82,7 +82,7 @@ jobs:
     name: Rocq Proofs (13 files)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: cachix/install-nix-action@v31
 
diff --git a/.github/workflows/fuzz-smoke.yml b/.github/workflows/fuzz-smoke.yml
index 78da13d..770a209 100644
--- a/.github/workflows/fuzz-smoke.yml
+++ b/.github/workflows/fuzz-smoke.yml
@@ -57,7 +57,7 @@ jobs:
           - mem_slab_fuzz
           - precondition_erasure
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install nightly Rust
         uses: dtolnay/rust-toolchain@nightly
diff --git a/.github/workflows/gust-renode.yml b/.github/workflows/gust-renode.yml
index e5567bb..8c6da5c 100644
--- a/.github/workflows/gust-renode.yml
+++ b/.github/workflows/gust-renode.yml
@@ -34,7 +34,7 @@ jobs:
       run:
         working-directory: benches/gust/renode-test
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Cache the Bazel repo cache (the hermetic Renode portable + .NET, ~hundreds
       # of MB, and the rules_renode/rules_python fetches) keyed on the module deps.
diff --git a/.github/workflows/llvm-lto.yml b/.github/workflows/llvm-lto.yml
index 3321e1f..8da1ef3 100644
--- a/.github/workflows/llvm-lto.yml
+++ b/.github/workflows/llvm-lto.yml
@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
@@ -332,7 +332,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 159d6e2..37e3bb8 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@nightly
 
@@ -86,7 +86,7 @@ jobs:
           - mem_slab_fuzz
           - precondition_erasure
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@nightly
 
@@ -162,7 +162,7 @@ jobs:
             test_path: tests/kernel/semaphore/semaphore
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 442cbc0..8d9ccbd 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -31,7 +31,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
         with:
diff --git a/.github/workflows/release-wasm.yml b/.github/workflows/release-wasm.yml
index 8254f82..ac31152 100644
--- a/.github/workflows/release-wasm.yml
+++ b/.github/workflows/release-wasm.yml
@@ -25,7 +25,7 @@ jobs:
     env:
       HOME: /root
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install Rust + wasm32 target
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17916e4..d317419 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
     env:
       HOME: /root
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -112,7 +112,7 @@ jobs:
       id-token: write       # cosign keyless + provenance OIDC
       attestations: write   # SLSA build provenance
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
diff --git a/.github/workflows/renode-tests.yml b/.github/workflows/renode-tests.yml
index 2927491..24c834e 100644
--- a/.github/workflows/renode-tests.yml
+++ b/.github/workflows/renode-tests.yml
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml
index 2ebfad9..71f1d3f 100644
--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -61,7 +61,7 @@ jobs:
           - sanitizer: leak
             runner: '["self-hosted", "linux", "x64", "rust-cpu"]'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install nightly Rust + rust-src
         uses: dtolnay/rust-toolchain@nightly
diff --git a/.github/workflows/zephyr-tests.yml b/.github/workflows/zephyr-tests.yml
index e518411..2ba00e6 100644
--- a/.github/workflows/zephyr-tests.yml
+++ b/.github/workflows/zephyr-tests.yml
@@ -161,7 +161,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
@@ -247,7 +247,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
@@ -348,7 +348,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale
 
@@ -415,7 +415,7 @@ jobs:
 
     steps:
       - name: Checkout Gale
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: gale