diff --git a/.github/workflows/_ci-bash.yml b/.github/workflows/_ci-bash.yml
index ac1cec2e..8fe81ef9 100644
--- a/.github/workflows/_ci-bash.yml
+++ b/.github/workflows/_ci-bash.yml
@@ -25,7 +25,7 @@ jobs:
     name: ShellCheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Run shellcheck
         run: |
           set -euo pipefail
@@ -40,7 +40,7 @@ jobs:
     name: bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Install bats
         run: sudo apt-get update && sudo apt-get install -y bats
       - name: Run bats
diff --git a/.github/workflows/_ci-docker.yml b/.github/workflows/_ci-docker.yml
index 9ee82ee1..6f45f555 100644
--- a/.github/workflows/_ci-docker.yml
+++ b/.github/workflows/_ci-docker.yml
@@ -28,7 +28,7 @@ jobs:
     name: docker build (validation)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Build (no push)
diff --git a/.github/workflows/_ci-npm.yml b/.github/workflows/_ci-npm.yml
index 82708384..928a8df8 100644
--- a/.github/workflows/_ci-npm.yml
+++ b/.github/workflows/_ci-npm.yml
@@ -23,7 +23,7 @@ jobs:
     name: pnpm install + test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - uses: actions/setup-node@v4
         with: { node-version: "${{ inputs.node_version }}" }
       - uses: pnpm/action-setup@v6
diff --git a/.github/workflows/_ci-rust.yml b/.github/workflows/_ci-rust.yml
index d06cc807..e80a6c4a 100644
--- a/.github/workflows/_ci-rust.yml
+++ b/.github/workflows/_ci-rust.yml
@@ -45,7 +45,7 @@ jobs:
     name: Workspace guard
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Verify Cargo.toml exists at workspace_dir
         run: test -f "${{ inputs.workspace_dir }}/Cargo.toml" || { echo "::error::No Cargo.toml at ${{ inputs.workspace_dir }}"; exit 1; }
 
@@ -54,7 +54,7 @@ jobs:
     name: cargo fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ inputs.toolchain }}
@@ -67,7 +67,7 @@ jobs:
     name: cargo clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ inputs.toolchain }}
@@ -91,7 +91,7 @@ jobs:
     name: cargo test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ inputs.toolchain }}
@@ -114,7 +114,7 @@ jobs:
     name: cargo build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Install musl tools (if requested)
         if: ${{ inputs.install_musl_tools }}
         run: sudo apt-get update && sudo apt-get install -y musl-tools
diff --git a/.github/workflows/_release-cargo-dist.yml b/.github/workflows/_release-cargo-dist.yml
index 3be48c62..97e734ca 100644
--- a/.github/workflows/_release-cargo-dist.yml
+++ b/.github/workflows/_release-cargo-dist.yml
@@ -42,7 +42,7 @@ jobs:
           - { os: macos-latest,   target: aarch64-apple-darwin,      platform: macos-aarch64 }
           - { os: windows-latest, target: x86_64-pc-windows-msvc,    platform: windows-x86_64 }
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/build-base-image.yml b/.github/workflows/build-base-image.yml
index e3556349..3ae4cf85 100644
--- a/.github/workflows/build-base-image.yml
+++ b/.github/workflows/build-base-image.yml
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set build arguments
         id: args
diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index 5313aaf2..69f8ae85 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Restore lychee cache
         uses: actions/cache@v5.0.5
@@ -68,7 +68,7 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Restore lychee cache
         uses: actions/cache@v5.0.5
diff --git a/.github/workflows/ci-v1.yml b/.github/workflows/ci-v1.yml
index 6ec0524c..be5046cd 100644
--- a/.github/workflows/ci-v1.yml
+++ b/.github/workflows/ci-v1.yml
@@ -24,7 +24,7 @@ jobs:
     name: Markdown lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Lint v1/CHANGELOG.md and root markdown
         uses: DavidAnson/markdownlint-cli2-action@v23
         with:
diff --git a/.github/workflows/ci-v2.yml b/.github/workflows/ci-v2.yml
index 48947a29..ff9d1bac 100644
--- a/.github/workflows/ci-v2.yml
+++ b/.github/workflows/ci-v2.yml
@@ -87,7 +87,7 @@ jobs:
       image-digest: ${{ steps.build.outputs.digest }}
       image-ref: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -154,7 +154,7 @@ jobs:
     outputs:
       providers: ${{ steps.matrix.outputs.providers }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Generate matrices
         id: matrix
@@ -194,7 +194,7 @@ jobs:
       packages: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Login to GHCR
         uses: docker/login-action@v4
diff --git a/.github/workflows/ci-v3.yml b/.github/workflows/ci-v3.yml
index c8464a06..a534bb74 100644
--- a/.github/workflows/ci-v3.yml
+++ b/.github/workflows/ci-v3.yml
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
         with:
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [rust]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -213,7 +213,7 @@ jobs:
       image-tag: ${{ steps.build.outputs.tag }}
       image-digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -313,7 +313,7 @@ jobs:
       packages: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Login to GHCR
         uses: docker/login-action@v4
@@ -399,7 +399,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'push' || github.event.inputs.run-audit == 'true'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -450,7 +450,7 @@ jobs:
     name: Documentation Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -483,7 +483,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.inputs.test-extensions == 'true' || github.event_name != 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Check if v3 extensions exist
         id: check
@@ -523,7 +523,7 @@ jobs:
     needs: [rust]
     continue-on-error: true  # Don't fail CI if k8s tests fail
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -568,7 +568,7 @@ jobs:
     needs: [rust]
     continue-on-error: true  # Don't fail CI if k8s tests fail
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -622,7 +622,7 @@ jobs:
       matrix:
         provider: [kind, k3d]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -700,7 +700,7 @@ jobs:
       matrix:
         provider: [runpod, northflank]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -737,7 +737,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [rust]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -762,7 +762,7 @@ jobs:
     needs: [rust]
     continue-on-error: true  # Config validation is informational, don't block PRs
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
diff --git a/.github/workflows/ci-v4.yml b/.github/workflows/ci-v4.yml
index 4345d428..4a30b72b 100644
--- a/.github/workflows/ci-v4.yml
+++ b/.github/workflows/ci-v4.yml
@@ -43,7 +43,7 @@ jobs:
           # can't see `matrix` context — so we keep the slot as a comment.)
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -88,7 +88,7 @@ jobs:
     name: Build Windows ARM64 (Tier 2)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - uses: dtolnay/rust-toolchain@stable
         with: { targets: aarch64-pc-windows-msvc }
       - name: Cross-compile (build only)
@@ -102,7 +102,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
 
diff --git a/.github/workflows/integration-test-providers.yml b/.github/workflows/integration-test-providers.yml
index dbe4ddd6..0351e9a2 100644
--- a/.github/workflows/integration-test-providers.yml
+++ b/.github/workflows/integration-test-providers.yml
@@ -44,7 +44,7 @@ jobs:
     name: Build Sindri CLI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -74,7 +74,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -124,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -178,7 +178,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, validate-runpod-configs]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
@@ -246,7 +246,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, validate-northflank-configs]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download sindri binary
         uses: actions/download-artifact@v8.0.1
diff --git a/.github/workflows/monitor-ubuntu-2604-arm.yml b/.github/workflows/monitor-ubuntu-2604-arm.yml
index ad69bb8a..6aa5ac56 100644
--- a/.github/workflows/monitor-ubuntu-2604-arm.yml
+++ b/.github/workflows/monitor-ubuntu-2604-arm.yml
@@ -46,7 +46,7 @@ jobs:
     if: needs.probe.result == 'success'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: main
           fetch-depth: 1
diff --git a/.github/workflows/registry-core-publish.yml b/.github/workflows/registry-core-publish.yml
index 392db031..7c9aa835 100644
--- a/.github/workflows/registry-core-publish.yml
+++ b/.github/workflows/registry-core-publish.yml
@@ -101,7 +101,7 @@ jobs:
       tag: ${{ steps.derive.outputs.tag }}
       dry_run: ${{ steps.derive.outputs.dry_run }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
           fetch-depth: 0
@@ -146,7 +146,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [resolve-tag]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
       - uses: dtolnay/rust-toolchain@stable
@@ -204,7 +204,7 @@ jobs:
           - { os: windows-latest,   runner: windows,     sample-component: "winget:GitHub.cli" }
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
       - uses: dtolnay/rust-toolchain@stable
@@ -278,7 +278,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [resolve-tag]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
 
@@ -421,7 +421,7 @@ jobs:
     outputs:
       index-path: ${{ steps.gen.outputs.index-path }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
       - uses: dtolnay/rust-toolchain@stable
@@ -519,7 +519,7 @@ jobs:
       reference: ${{ steps.push.outputs.reference }}
       artifact-path: ${{ steps.push.outputs.artifact-path }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
       - name: Download generated index
@@ -626,7 +626,7 @@ jobs:
       attestations: write   # store provenance in GitHub attestation store
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: v4
           sparse-checkout: |
diff --git a/.github/workflows/release-v2.yml b/.github/workflows/release-v2.yml
index 498f0fb1..a87cf762 100644
--- a/.github/workflows/release-v2.yml
+++ b/.github/workflows/release-v2.yml
@@ -57,7 +57,7 @@ jobs:
       ci_image: ${{ steps.verify.outputs.ci_image }}
       image_digest: ${{ steps.verify.outputs.image_digest }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -124,7 +124,7 @@ jobs:
       changelog: ${{ steps.changelog.outputs.changelog }}
       changelog_file: ${{ steps.changelog.outputs.changelog_file }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -159,7 +159,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           ref: main
           fetch-depth: 0
@@ -510,7 +510,7 @@ jobs:
     outputs:
       release_url: ${{ steps.release.outputs.url }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download changelog artifact
         uses: actions/download-artifact@v8.0.1
@@ -646,7 +646,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Notify success
         if: needs.create-release.result == 'success'
diff --git a/.github/workflows/release-v3.yml b/.github/workflows/release-v3.yml
index d8ba95ab..85b36a2c 100644
--- a/.github/workflows/release-v3.yml
+++ b/.github/workflows/release-v3.yml
@@ -53,7 +53,7 @@ jobs:
       changelog: ${{ steps.changelog.outputs.changelog }}
       changelog_file: ${{ steps.changelog.outputs.changelog_file }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -108,7 +108,7 @@ jobs:
             platform: windows-x86_64
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -188,7 +188,7 @@ jobs:
       commit_sha: ${{ steps.verify.outputs.commit_sha }}
       all_distros_available: ${{ steps.check-distros.outputs.all_distros_available }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -572,7 +572,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -677,7 +677,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           ref: main
           fetch-depth: 0
@@ -809,7 +809,7 @@ jobs:
     outputs:
       release_url: ${{ steps.release.outputs.url }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Download all binary artifacts
         uses: actions/download-artifact@v8.0.1
@@ -1034,7 +1034,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Notify success
         if: needs.create-release.result == 'success'
diff --git a/.github/workflows/release-v4.yml b/.github/workflows/release-v4.yml
index 99f61a1d..9d5d2e9f 100644
--- a/.github/workflows/release-v4.yml
+++ b/.github/workflows/release-v4.yml
@@ -54,7 +54,7 @@ jobs:
     needs: [validate-tag, build]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with: { ref: v4 }
       - name: Create release
         uses: softprops/action-gh-release@v2
diff --git a/.github/workflows/v2-deploy-sindri.yml b/.github/workflows/v2-deploy-sindri.yml
index d8f15e9a..6afe3724 100644
--- a/.github/workflows/v2-deploy-sindri.yml
+++ b/.github/workflows/v2-deploy-sindri.yml
@@ -34,7 +34,7 @@ jobs:
       app-url: ${{ steps.deploy.outputs.app-url }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: pip install yq
diff --git a/.github/workflows/v2-manual-deploy.yml b/.github/workflows/v2-manual-deploy.yml
index d7b3c870..09528402 100644
--- a/.github/workflows/v2-manual-deploy.yml
+++ b/.github/workflows/v2-manual-deploy.yml
@@ -89,7 +89,7 @@ jobs:
       region: ${{ steps.validate.outputs.region }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Validate and process inputs
         id: validate
@@ -173,7 +173,7 @@ jobs:
       image-tag: ${{ steps.build.outputs.tag }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Build image
         id: build
@@ -192,7 +192,7 @@ jobs:
       deployment-status: ${{ steps.deploy.outputs.status }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Generate sindri.yaml
         run: |
@@ -337,7 +337,7 @@ jobs:
     needs: [validate-inputs, deploy]
     if: always() && github.event.inputs.notify-slack == 'true'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Prepare notification
         id: notification
diff --git a/.github/workflows/v2-teardown-sindri.yml b/.github/workflows/v2-teardown-sindri.yml
index bd70bf38..1d505d7b 100644
--- a/.github/workflows/v2-teardown-sindri.yml
+++ b/.github/workflows/v2-teardown-sindri.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: pip install yq
diff --git a/.github/workflows/v2-test-extensions.yml b/.github/workflows/v2-test-extensions.yml
index 213b8596..10adc716 100644
--- a/.github/workflows/v2-test-extensions.yml
+++ b/.github/workflows/v2-test-extensions.yml
@@ -40,7 +40,7 @@ jobs:
       count: ${{ steps.matrix.outputs.count }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: |
@@ -92,7 +92,7 @@ jobs:
     if: needs.generate-matrix.outputs.count > 0
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -126,7 +126,7 @@ jobs:
         extension: ${{ fromJson(needs.generate-matrix.outputs.extensions) }}
     steps:
       - name: Checkout for extension info
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           sparse-checkout: v2/docker/lib/extensions
 
diff --git a/.github/workflows/v2-test-profiles.yml b/.github/workflows/v2-test-profiles.yml
index ea53f2ca..9be5817e 100644
--- a/.github/workflows/v2-test-profiles.yml
+++ b/.github/workflows/v2-test-profiles.yml
@@ -141,7 +141,7 @@ jobs:
       count: ${{ steps.discover.outputs.count }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Discover sindri.yaml files
         id: discover
@@ -178,7 +178,7 @@ jobs:
         config: ${{ fromJson(needs.discover-configs.outputs.configs) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: pip install yq
diff --git a/.github/workflows/v2-test-provider.yml b/.github/workflows/v2-test-provider.yml
index a0111511..1cfdc2c9 100644
--- a/.github/workflows/v2-test-provider.yml
+++ b/.github/workflows/v2-test-provider.yml
@@ -96,7 +96,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       # Workflows live on main but the runner checks out the v2 branch (where
       # this workflow's caller lives). v2 doesn't have .github/actions/ or
@@ -104,7 +104,7 @@ jobs:
       # main's .github/ into _ci-shared/ so the local-action and helper-script
       # references below can resolve.
       - name: Side-checkout main's .github/ for shared actions/scripts
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           ref: main
           sparse-checkout: |
diff --git a/.github/workflows/v3-discover-extensions.yml b/.github/workflows/v3-discover-extensions.yml
index 0da4d351..61eed15c 100644
--- a/.github/workflows/v3-discover-extensions.yml
+++ b/.github/workflows/v3-discover-extensions.yml
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0  # Needed for changed detection
 
diff --git a/.github/workflows/v3-extension-test.yml b/.github/workflows/v3-extension-test.yml
index 9b217dba..193371c2 100644
--- a/.github/workflows/v3-extension-test.yml
+++ b/.github/workflows/v3-extension-test.yml
@@ -141,7 +141,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/v3-packer-build.yml b/.github/workflows/v3-packer-build.yml
index cc36d520..b5e1b02d 100644
--- a/.github/workflows/v3-packer-build.yml
+++ b/.github/workflows/v3-packer-build.yml
@@ -45,7 +45,7 @@ jobs:
     name: Validate Packer Templates
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -105,7 +105,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v6
@@ -158,7 +158,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Azure Login
         uses: azure/login@v3
@@ -214,7 +214,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v3
@@ -270,7 +270,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Configure OCI Credentials
         run: |
@@ -346,7 +346,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Configure Alibaba Cloud Credentials
         run: |
diff --git a/.github/workflows/v3-packer-test.yml b/.github/workflows/v3-packer-test.yml
index 0eb0a1a5..6b147173 100644
--- a/.github/workflows/v3-packer-test.yml
+++ b/.github/workflows/v3-packer-test.yml
@@ -42,7 +42,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v6
@@ -119,7 +119,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Azure Login
         uses: azure/login@v3
@@ -178,7 +178,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v3
@@ -244,7 +244,7 @@ jobs:
       OCI_TENANCY_OCID: ${{ secrets.OCI_TENANCY_OCID }}
       OCI_API_KEY: ${{ secrets.OCI_API_KEY }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Configure OCI Credentials
         run: |
@@ -305,7 +305,7 @@ jobs:
       ALICLOUD_ACCESS_KEY: ${{ secrets.ALICLOUD_ACCESS_KEY }}
       ALICLOUD_SECRET_KEY: ${{ secrets.ALICLOUD_SECRET_KEY }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
diff --git a/.github/workflows/v3-pre-release-test.yml b/.github/workflows/v3-pre-release-test.yml
index 6f2b3863..4a74f8ea 100644
--- a/.github/workflows/v3-pre-release-test.yml
+++ b/.github/workflows/v3-pre-release-test.yml
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/v3-provider-devpod.yml b/.github/workflows/v3-provider-devpod.yml
index be0d6376..59bef32e 100644
--- a/.github/workflows/v3-provider-devpod.yml
+++ b/.github/workflows/v3-provider-devpod.yml
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Check credentials
         uses: ./.github/actions/shared/check-credentials
         with:
@@ -85,7 +85,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install DevPod
         run: |
diff --git a/.github/workflows/v3-provider-docker.yml b/.github/workflows/v3-provider-docker.yml
index ebfbd28a..5f9019c1 100644
--- a/.github/workflows/v3-provider-docker.yml
+++ b/.github/workflows/v3-provider-docker.yml
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -81,7 +81,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Download CLI
         uses: actions/download-artifact@v8.0.1
diff --git a/.github/workflows/v3-provider-e2b.yml b/.github/workflows/v3-provider-e2b.yml
index fa588f75..4950bfec 100644
--- a/.github/workflows/v3-provider-e2b.yml
+++ b/.github/workflows/v3-provider-e2b.yml
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Check credentials
         uses: ./.github/actions/shared/check-credentials
         with:
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -187,7 +187,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
diff --git a/.github/workflows/v3-provider-fly.yml b/.github/workflows/v3-provider-fly.yml
index 54a5df93..fa67cf16 100644
--- a/.github/workflows/v3-provider-fly.yml
+++ b/.github/workflows/v3-provider-fly.yml
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Check credentials
         uses: ./.github/actions/shared/check-credentials
         with:
@@ -76,7 +76,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Fly CLI
         uses: superfly/flyctl-actions/setup-flyctl@master
diff --git a/.github/workflows/v3-provider-k3d.yml b/.github/workflows/v3-provider-k3d.yml
index 0cac1470..6174f21a 100644
--- a/.github/workflows/v3-provider-k3d.yml
+++ b/.github/workflows/v3-provider-k3d.yml
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install k3d
         run: |
diff --git a/.github/workflows/v3-provider-northflank.yml b/.github/workflows/v3-provider-northflank.yml
index a9dadf6b..bef3a8b1 100644
--- a/.github/workflows/v3-provider-northflank.yml
+++ b/.github/workflows/v3-provider-northflank.yml
@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Check credentials
         uses: ./.github/actions/shared/check-credentials
         with:
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install Northflank CLI
         run: |
diff --git a/.github/workflows/v3-provider-packer.yml b/.github/workflows/v3-provider-packer.yml
index 8c147d1d..fed53bcf 100644
--- a/.github/workflows/v3-provider-packer.yml
+++ b/.github/workflows/v3-provider-packer.yml
@@ -74,7 +74,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Check credentials
         uses: ./.github/actions/shared/check-credentials
         with:
@@ -105,7 +105,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -323,7 +323,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Configure Cloud CLI
         run: |
diff --git a/.github/workflows/v3-provider-runpod.yml b/.github/workflows/v3-provider-runpod.yml
index 550399d5..5e2d6869 100644
--- a/.github/workflows/v3-provider-runpod.yml
+++ b/.github/workflows/v3-provider-runpod.yml
@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Check credentials
         uses: ./.github/actions/shared/check-credentials
         with:
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install runpodctl
         run: |
diff --git a/.github/workflows/v3-test-profiles.yml b/.github/workflows/v3-test-profiles.yml
index 30113b4a..cfc25a71 100644
--- a/.github/workflows/v3-test-profiles.yml
+++ b/.github/workflows/v3-test-profiles.yml
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -103,7 +103,7 @@ jobs:
       count: ${{ steps.discover.outputs.count }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Discover sindri.yaml files
         id: discover
@@ -140,7 +140,7 @@ jobs:
         config: ${{ fromJson(needs.discover-configs.outputs.configs) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Download CLI artifact
         uses: actions/download-artifact@v8.0.1
diff --git a/.github/workflows/validate-markdown.yml b/.github/workflows/validate-markdown.yml
index d98ccf79..af4ec7b1 100644
--- a/.github/workflows/validate-markdown.yml
+++ b/.github/workflows/validate-markdown.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
diff --git a/.github/workflows/validate-shell.yml b/.github/workflows/validate-shell.yml
index 3e24fec4..0ea1e081 100644
--- a/.github/workflows/validate-shell.yml
+++ b/.github/workflows/validate-shell.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install shellcheck
         run: |
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install shellcheck
         run: |
diff --git a/.github/workflows/validate-yaml.yml b/.github/workflows/validate-yaml.yml
index 44e5041e..79b67a95 100644
--- a/.github/workflows/validate-yaml.yml
+++ b/.github/workflows/validate-yaml.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Skip if v2 source not present
         id: gate
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yamllint
         run: pip install yamllint
@@ -93,7 +93,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yamllint
         run: pip install yamllint
@@ -108,7 +108,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -140,7 +140,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -189,7 +189,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: |
@@ -209,7 +209,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: |
@@ -243,7 +243,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: |
@@ -266,7 +266,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: |
@@ -332,7 +332,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Install yq
         run: |