diff --git a/.github/workflows/_reusable-lighthouse.yml b/.github/workflows/_reusable-lighthouse.yml
index b4d342b..1266597 100644
--- a/.github/workflows/_reusable-lighthouse.yml
+++ b/.github/workflows/_reusable-lighthouse.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
         with:
           version: 9
diff --git a/.github/workflows/a11y-axe.yml b/.github/workflows/a11y-axe.yml
index 34cd1e9..24dd113 100644
--- a/.github/workflows/a11y-axe.yml
+++ b/.github/workflows/a11y-axe.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index f09bc4a..80a6fc3 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
diff --git a/.github/workflows/brand-token-guard.yml b/.github/workflows/brand-token-guard.yml
index 6a882fa..ff383a7 100644
--- a/.github/workflows/brand-token-guard.yml
+++ b/.github/workflows/brand-token-guard.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true  # advisory-only until B-series migration completes (P4-26)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Check for hardcoded brand hex values
         run: |
           HEX_PATTERN='#(C9F27A|79C24C|1E5E2F|0D2F17|c9f27a|79c24c|1e5e2f|0d2f17)'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8f4ced..1831692 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
     name: Lint & Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
         with:
           version: 9
@@ -38,7 +38,7 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
         with:
           version: 9
@@ -54,7 +54,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
         with:
           version: 9
@@ -74,7 +74,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
         with:
           version: 9
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 2c3e2a1..86d13ab 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -13,7 +13,7 @@ jobs:
     name: Lint commit messages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/consent-banner-gate.yml b/.github/workflows/consent-banner-gate.yml
index 94054d7..e53880c 100644
--- a/.github/workflows/consent-banner-gate.yml
+++ b/.github/workflows/consent-banner-gate.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check ConsentProvider in root layout
         run: |
diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index 5019f29..1b6feb1 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -31,7 +31,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2142fc5..6ca06a9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
         with:
@@ -56,7 +56,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Download SBOM
         uses: actions/download-artifact@v4
diff --git a/.github/workflows/security-secrets-check.yml b/.github/workflows/security-secrets-check.yml
index 043da37..42c173a 100644
--- a/.github/workflows/security-secrets-check.yml
+++ b/.github/workflows/security-secrets-check.yml
@@ -16,7 +16,7 @@ jobs:
     name: Grep — NEXT_PUBLIC_HASURA_ADMIN_SECRET must be zero
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Fail if NEXT_PUBLIC_HASURA_ADMIN_SECRET is found in source
         run: |
@@ -43,7 +43,7 @@ jobs:
     name: Grep — VERCEL_OIDC_TOKEN must not be committed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Fail if VERCEL_OIDC_TOKEN value is committed in tracked files
         run: |
@@ -74,7 +74,7 @@ jobs:
     name: Grep — ANTHROPIC_API_KEY must not have a real value committed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Fail if real Anthropic API key is found in tracked files
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 10b7b41..129d28a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
         with:
diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml
index b9c21c2..f1086bf 100644
--- a/.github/workflows/wiki-sync.yml
+++ b/.github/workflows/wiki-sync.yml
@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: Andrew-Chen-Wang/github-wiki-action@v4
         with:
           path: '.github/wiki'