diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index b3d84c40..e66fb39e 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -16,7 +16,7 @@ jobs:
       tag: ${{ steps.release_tag.outputs.tag }}
       version: ${{ steps.release_tag.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Resolve release tag & version
@@ -57,7 +57,7 @@ jobs:
       VERSION: ${{ needs.prepare.outputs.version }}
       TAG: ${{ needs.prepare.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Checkout release tag
diff --git a/.github/workflows/bump-chart-version.yml b/.github/workflows/bump-chart-version.yml
index 82dd2d9f..b1069917 100644
--- a/.github/workflows/bump-chart-version.yml
+++ b/.github/workflows/bump-chart-version.yml
@@ -19,7 +19,7 @@ jobs:
   bump:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref || 'main' }}
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 9baae726..e723eaa8 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -16,7 +16,7 @@ jobs:
       }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.PR_AUTOMATION_TOKEN }}
diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index 5b0546ba..53442a4e 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -22,7 +22,7 @@ jobs:
       infrastructure: ${{ steps.filter_pr.outputs.infrastructure || steps.filter_merge.outputs.infrastructure || steps.manual.outputs.infrastructure }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -106,7 +106,7 @@ jobs:
         service: ["admin-backend", "document-extractor", "rag-backend", "mcp-server"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set Docker Image Name
         run: |
@@ -136,7 +136,7 @@ jobs:
         library: ["rag-core-lib", "rag-core-api", "admin-api-lib", "extractor-api-lib"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set Docker Image Name
         run: |
@@ -167,7 +167,7 @@ jobs:
     if: needs.changes.outputs.frontend == 'true' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -211,7 +211,7 @@ jobs:
     if: needs.changes.outputs.infrastructure == 'true' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index ee133dbb..5c1edc6a 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -37,7 +37,7 @@ jobs:
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: echo "releasable=true" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: ${{ github.event_name == 'pull_request' }}
         with:
           fetch-depth: 0
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [changes]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/promote-clean-semver.yml b/.github/workflows/promote-clean-semver.yml
index b3f053f9..18bf64ae 100644
--- a/.github/workflows/promote-clean-semver.yml
+++ b/.github/workflows/promote-clean-semver.yml
@@ -30,7 +30,7 @@ jobs:
     name: Publish clean semver, refresh locks, bump appVersion
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref || 'main' }}
diff --git a/.github/workflows/publish-chart-packages.yml b/.github/workflows/publish-chart-packages.yml
index a1005e06..6a6bdb62 100644
--- a/.github/workflows/publish-chart-packages.yml
+++ b/.github/workflows/publish-chart-packages.yml
@@ -28,7 +28,7 @@ jobs:
       allow: ${{ steps.allow_manual.outputs.allow || steps.allow_push.outputs.allow }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Allow manual run
         id: allow_manual
         if: ${{ github.event_name == 'workflow_dispatch' }}
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ needs.gate.outputs.allow == 'true' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref || 'main' }}
diff --git a/.github/workflows/publish-pre-and-qa.yml b/.github/workflows/publish-pre-and-qa.yml
index 37f9c8fc..2280c539 100644
--- a/.github/workflows/publish-pre-and-qa.yml
+++ b/.github/workflows/publish-pre-and-qa.yml
@@ -29,7 +29,7 @@ jobs:
       version: ${{ steps.ver.outputs.version }}
       clean_version: ${{ steps.ver.outputs.clean_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -150,7 +150,7 @@ jobs:
     env:
       PRE_RELEASE_VERSION: ${{ needs.publish-pre.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -201,7 +201,7 @@ jobs:
     env:
       PRE_RELEASE_VERSION: ${{ needs.publish-pre.outputs.version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index f72dc2a6..fbaeac31 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Self-hosted Renovate
         uses: renovatebot/github-action@v43.0.20
         with: