diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f8cb4c6..978b2cf7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -52,7 +52,7 @@ jobs:
     name: Unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -87,7 +87,7 @@ jobs:
       # in-process builtin), so e2e steps must find the built adapter plugins.
       CRITERIA_ADAPTERS: ${{ github.workspace }}/bin
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -121,7 +121,7 @@ jobs:
     name: Install script syntax
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - name: install-script-syntax
         run: make lint-sh
@@ -130,7 +130,7 @@ jobs:
     name: Homebrew tap update script
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
@@ -158,7 +158,7 @@ jobs:
     name: Proto drift check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: bufbuild/buf-setup-action@v1
         with:
@@ -188,7 +188,7 @@ jobs:
     # now a required check in all-checks. A PR introducing a dependency with a
     # known OSV advisory fails CI until upgraded or time-boxed in osv-scanner.toml.
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -218,7 +218,7 @@ jobs:
     # upstream release cadence. This job only surfaces drift on every PR.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -261,7 +261,7 @@ jobs:
       )
     needs: [unit-tests, e2e]
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -334,7 +334,7 @@ jobs:
     # lower the floor with a documented reason.
     needs: unit-tests
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
diff --git a/.github/workflows/publish-adapter-mcp.yml b/.github/workflows/publish-adapter-mcp.yml
index 66f3accd..8cc9687d 100644
--- a/.github/workflows/publish-adapter-mcp.yml
+++ b/.github/workflows/publish-adapter-mcp.yml
@@ -23,7 +23,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb8ca059..8d1cfdf9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     name: Validate release source
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Enforce release-source policy
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: guard
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
@@ -86,7 +86,7 @@ jobs:
     env:
       CRITERIA_ADAPTERS: ${{ github.workspace }}/bin
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
@@ -117,7 +117,7 @@ jobs:
         ports:
           - 5000:5000
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
@@ -157,7 +157,7 @@ jobs:
           - goos: darwin
             goarch: arm64
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
@@ -204,7 +204,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [guard, gate-conformance, gate-e2e, gate-remote, gate-publish]
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -234,7 +234,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, docker-image]
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - name: Download all release artifacts
         uses: actions/download-artifact@v8
@@ -286,7 +286,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [checksum-and-sign]
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -354,7 +354,7 @@ jobs:
     needs: release
     if: "!contains(github.ref_name, '-')"
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
@@ -375,7 +375,7 @@ jobs:
           permission-contents: write
 
       - name: Check out Homebrew tap
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@v7
         with:
           repository: brokenbots/homebrew-criteria
           path: tap
diff --git a/.github/workflows/remote-e2e.yml b/.github/workflows/remote-e2e.yml
index 7c8e8324..5df8f024 100644
--- a/.github/workflows/remote-e2e.yml
+++ b/.github/workflows/remote-e2e.yml
@@ -14,7 +14,7 @@ jobs:
     name: Remote adapter end-to-end
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with: