diff --git a/.github/workflows/exercise-path.yml b/.github/workflows/exercise-path.yml
index 54c92c9c..3d04c9e4 100644
--- a/.github/workflows/exercise-path.yml
+++ b/.github/workflows/exercise-path.yml
@@ -37,7 +37,7 @@ jobs:
     name: Build quota-router-core
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Build with all features (--features full per RFC-0917 mutex)
         run: cargo build -p quota-router-core --features full
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Run 11-step exercise under --features full (per RFC-0917 mutex; litellm-mode + any-llm-mode mutually exclusive)
         run: cargo test -p quota-router-core --test eleven_step --features full
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Run body-field linter via gating egress_boundary integration tests
         # Mission 0957-b AC-1 + RFC-0957 §Adversary A5 body-leakage defense.
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Verify goldens match (RFC-0959 v1.0 settlement_hash + receipt_id check-ins)
         run: cargo test -p quota-router-core --test goldens --features full
@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Run cross-impl ZK vectors (RFC-0958 §Test Vectors TV1+TV2 + RFC-0959 v1.0 settlement hash)
         run: cargo test -p quota-router-core --test zk_vectors --features full
@@ -109,7 +109,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: 8 RFC-0958 test vectors + RFC-0959 settlement hash replay defense
         # cargo-fuzz target `capability_verify` is NOT yet wired (TBD by