diff --git a/.github/workflows/preview-page-coverage.yml b/.github/workflows/preview-page-coverage.yml
index 32c7950..b79cda3 100644
--- a/.github/workflows/preview-page-coverage.yml
+++ b/.github/workflows/preview-page-coverage.yml
@@ -62,7 +62,7 @@ jobs:
       matrix:
         env: ${{ fromJSON(needs.resolve-env.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Wait for Mintlify to deploy (push events only)
         if: github.event_name == 'push'
diff --git a/.github/workflows/sdk-extras-check.yml b/.github/workflows/sdk-extras-check.yml
index 1756393..de4554e 100644
--- a/.github/workflows/sdk-extras-check.yml
+++ b/.github/workflows/sdk-extras-check.yml
@@ -44,7 +44,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate documented extras against PyPI
         run: python3 scripts/check-sdk-extras.py
diff --git a/.github/workflows/sync-docs.yml b/.github/workflows/sync-docs.yml
index 6db95f6..2148b89 100644
--- a/.github/workflows/sync-docs.yml
+++ b/.github/workflows/sync-docs.yml
@@ -44,7 +44,7 @@ jobs:
       YQ_VERSION: "4.44.3"
       YQ_SHA256: "a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7"
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -195,7 +195,22 @@ jobs:
 
       - name: Open or update PR
         if: steps.filter.outputs.count != '0'
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        # v8, and BOTH halves of that are load-bearing.
+        #
+        # Compatibility: checkout v6+ writes its credentials under $RUNNER_TEMP,
+        # and create-pull-request before v7.0.9 then sends a duplicate
+        # `Authorization` header and fails this step outright
+        # (peter-evans/create-pull-request#4228, fixed by #4230). Bumping checkout
+        # to v7.0.1 in this commit while leaving v6.1.0 here would have stopped
+        # the docs sync opening or updating PRs at all — silently, since a sync
+        # that never runs files no complaint (Bugbot).
+        #
+        # Runtime: v7.0.11 fixes the clash but is still `using: node20`, so it
+        # would have failed THIS commit's whole purpose. v8.0.0 is the first
+        # `node24` release. Its only breaking change is requiring Actions Runner
+        # v2.327.1+ on SELF-HOSTED runners; every job in this repo is
+        # GitHub-hosted, so it does not apply here.
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           base: ${{ steps.setup.outputs.base }}
           branch: docs/sync-upstream