diff --git a/.github/workflows/build-subtitle-cache.yml b/.github/workflows/build-subtitle-cache.yml
index ce4e08e6..89457771 100644
--- a/.github/workflows/build-subtitle-cache.yml
+++ b/.github/workflows/build-subtitle-cache.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 720
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: astral-sh/setup-uv@v7
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1392042f..e67e042c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
       is_release: ${{ steps.detect.outputs.is_release }}
       os_matrix: ${{ steps.detect.outputs.os_matrix }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # need base history for the changed-file diff
       - id: detect
@@ -83,7 +83,7 @@ jobs:
     name: Changelog Version Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # The GitHub release body is generated from the matching CHANGELOG.md
       # section (see release.yml), so a `chore: release vX.Y.Z` PR must ship its
       # changelog entry. This fails such a PR fast — before the ~20-min binary
@@ -103,7 +103,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -130,7 +130,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -187,7 +187,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -234,7 +234,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -278,7 +278,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -331,7 +331,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -353,7 +353,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -384,7 +384,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
@@ -426,7 +426,7 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
@@ -452,7 +452,7 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
@@ -476,7 +476,7 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index d8a3cdb9..fedd06f0 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
index 48def19e..67e4bc0b 100644
--- a/.github/workflows/code-review.yml
+++ b/.github/workflows/code-review.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1a2a668e..39c866bd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,7 @@ jobs:
         language: ["python", "javascript-typescript"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/contributor-welcome.yml b/.github/workflows/contributor-welcome.yml
index 10aff7a8..1983501e 100644
--- a/.github/workflows/contributor-welcome.yml
+++ b/.github/workflows/contributor-welcome.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Default ref under pull_request_target is the BASE branch (trusted repo
       # code), not the fork's PR head — so requiring the greeting script is safe.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/github-script@v9
         with:
           script: |
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 34836d4d..3ce2c788 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -40,7 +40,7 @@ jobs:
     if: >-
       !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.title, 'chore: release v'))
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # When dispatched with an explicit tag, check out that tag's code.
           ref: ${{ inputs.tag || github.sha }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1bd4a9da..a75f6ce6 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -13,7 +13,7 @@ jobs:
     name: Deploy Documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
diff --git a/.github/workflows/download-stats.yml b/.github/workflows/download-stats.yml
index 37bcf94b..955114a7 100644
--- a/.github/workflows/download-stats.yml
+++ b/.github/workflows/download-stats.yml
@@ -21,7 +21,7 @@ jobs:
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/makemkv-install.yml b/.github/workflows/makemkv-install.yml
index 5a037864..b30a5e3c 100644
--- a/.github/workflows/makemkv-install.yml
+++ b/.github/workflows/makemkv-install.yml
@@ -25,7 +25,7 @@ jobs:
           - "1.18.3"  # pinned baseline; update when a new version releases
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install MakeMKV build dependencies
         run: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b19a9166..91e757d7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -17,7 +17,7 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f498f2f9..05145e10 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
     name: Build Windows Executable
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Build frontend
       - uses: actions/setup-node@v6
@@ -173,7 +173,7 @@ jobs:
     name: Build Linux Executable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Build frontend
       - uses: actions/setup-node@v6
@@ -317,7 +317,7 @@ jobs:
     # so GPU on Jetson is an opt-in on-device step (see docs/development/jetson.md).
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Build frontend
       - uses: actions/setup-node@v6
@@ -457,7 +457,7 @@ jobs:
     name: Build Linux Executable (x64, headless/server)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -587,7 +587,7 @@ jobs:
     name: Build Linux Executable (arm64, headless/server)
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with:
@@ -724,7 +724,7 @@ jobs:
             arch: arm64
             file_arch: arm64
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Build frontend
       - uses: actions/setup-node@v6
@@ -863,7 +863,7 @@ jobs:
     needs: [build-windows, build-linux, build-linux-arm64, build-macos, build-linux-headless, build-linux-arm64-headless]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Need CHANGELOG.md for the release body and full tag history so the
           # "Full Changelog" compare link can resolve the previous tag.
diff --git a/.github/workflows/subtitle-cache-smoke.yml b/.github/workflows/subtitle-cache-smoke.yml
index 308a5dd0..7dcc9b19 100644
--- a/.github/workflows/subtitle-cache-smoke.yml
+++ b/.github/workflows/subtitle-cache-smoke.yml
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: astral-sh/setup-uv@v7
         with:
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index af3dc259..c5b2f134 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -19,7 +19,7 @@ jobs:
     # Squash-merge of a release PR produces "chore: release v0.x.y (#NNN)"
     if: "contains(github.event.head_commit.message, 'chore: release v')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract version from pyproject.toml
         id: version