diff --git a/.github/workflows/aead-build_test.yml b/.github/workflows/aead-build_test.yml
index 90cfb2044..2ea5f02df 100644
--- a/.github/workflows/aead-build_test.yml
+++ b/.github/workflows/aead-build_test.yml
@@ -26,7 +26,7 @@ jobs:
         shell: bash
         working-directory: crates/primitives/aead
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: 🛠️ Setup Rust Nightly
         run: rustup toolchain install nightly
@@ -59,7 +59,7 @@ jobs:
         working-directory: crates/primitives/aead
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
diff --git a/.github/workflows/aes-riscv-arm.yml b/.github/workflows/aes-riscv-arm.yml
index 5a6019cea..1b5ea0138 100644
--- a/.github/workflows/aes-riscv-arm.yml
+++ b/.github/workflows/aes-riscv-arm.yml
@@ -27,7 +27,7 @@ jobs:
         working-directory: crates/algorithms/aes
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
@@ -59,7 +59,7 @@ jobs:
         working-directory: crates/algorithms/aes
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
diff --git a/.github/workflows/aes.yml b/.github/workflows/aes.yml
index b7ee7ea65..3fd016696 100644
--- a/.github/workflows/aes.yml
+++ b/.github/workflows/aes.yml
@@ -36,7 +36,7 @@ jobs:
         working-directory: crates/algorithms/aes
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: taiki-e/install-action@cargo-hack
 
       - name: Update dependencies
@@ -127,7 +127,7 @@ jobs:
         working-directory: crates/algorithms/aes
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
@@ -152,7 +152,7 @@ jobs:
         working-directory: crates/algorithms/aes
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: 🛠️ Setup Rust Nightly
         run: |
diff --git a/.github/workflows/docker-c-build-test.yml b/.github/workflows/docker-c-build-test.yml
index 4e36171f5..f954b6f62 100644
--- a/.github/workflows/docker-c-build-test.yml
+++ b/.github/workflows/docker-c-build-test.yml
@@ -22,7 +22,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Log in to the Container registry
         uses: docker/login-action@v4
@@ -50,7 +50,7 @@ jobs:
         working-directory: libcrux-ml-kem/extracts/c_header_only
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C (header only)
         run: |
@@ -73,7 +73,7 @@ jobs:
         working-directory: libcrux-ml-kem/extracts/cpp_header_only
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C++ (header only)
         run: |
@@ -97,7 +97,7 @@ jobs:
         working-directory: libcrux-ml-dsa
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C (header only)
         run: |
diff --git a/.github/workflows/docker-c-push-latest.yml b/.github/workflows/docker-c-push-latest.yml
index 9c68ab50d..719de3b69 100644
--- a/.github/workflows/docker-c-push-latest.yml
+++ b/.github/workflows/docker-c-push-latest.yml
@@ -42,7 +42,7 @@ jobs:
       id-token: write
     
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Log in to the Container registry
         uses: docker/login-action@v4
         with:
diff --git a/.github/workflows/ecdh-build-test.yml b/.github/workflows/ecdh-build-test.yml
index 229aeda32..c4de9159c 100644
--- a/.github/workflows/ecdh-build-test.yml
+++ b/.github/workflows/ecdh-build-test.yml
@@ -42,7 +42,7 @@ jobs:
         working-directory: libcrux-ecdh
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
@@ -117,7 +117,7 @@ jobs:
         working-directory: libcrux-ecdh
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Add no_std target
         run: rustup target add thumbv6m-none-eabi
diff --git a/.github/workflows/get-hax-ref.yml b/.github/workflows/get-hax-ref.yml
index c5404636d..27cdc3bf6 100644
--- a/.github/workflows/get-hax-ref.yml
+++ b/.github/workflows/get-hax-ref.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       hax_ref: ${{ steps.step1.outputs.hax_ref }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: step1
         run: |
           # use hax from the commit at which hax-lib is pinned in the Cargo.toml of libcrux.
diff --git a/.github/workflows/kem-build-test.yml b/.github/workflows/kem-build-test.yml
index 69e012f2e..5fd8d49de 100644
--- a/.github/workflows/kem-build-test.yml
+++ b/.github/workflows/kem-build-test.yml
@@ -42,7 +42,7 @@ jobs:
         working-directory: libcrux-kem
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
diff --git a/.github/workflows/kmac-hax.yml b/.github/workflows/kmac-hax.yml
index 962e6e946..af2cc7d24 100644
--- a/.github/workflows/kmac-hax.yml
+++ b/.github/workflows/kmac-hax.yml
@@ -40,7 +40,7 @@ jobs:
       - get-hax-ref
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -68,7 +68,7 @@ jobs:
       - extract-portable
     if: ${{ github.event_name != 'merge_group' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -93,7 +93,7 @@ jobs:
       - extract-portable
     if: ${{ github.event_name != 'merge_group' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/libcrux-build-test.yml b/.github/workflows/libcrux-build-test.yml
index 7e9962c69..4810ce9cb 100644
--- a/.github/workflows/libcrux-build-test.yml
+++ b/.github/workflows/libcrux-build-test.yml
@@ -39,7 +39,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
@@ -140,7 +140,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984
 
       - name: Setup
diff --git a/.github/workflows/libcrux-ct-test.yml b/.github/workflows/libcrux-ct-test.yml
index 53af5e48f..f8435d2e1 100644
--- a/.github/workflows/libcrux-ct-test.yml
+++ b/.github/workflows/libcrux-ct-test.yml
@@ -23,7 +23,7 @@ jobs:
     name: Constant Time Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       
diff --git a/.github/workflows/libcrux-flake-update.yml b/.github/workflows/libcrux-flake-update.yml
index 76f6b7e7c..15641225b 100644
--- a/.github/workflows/libcrux-flake-update.yml
+++ b/.github/workflows/libcrux-flake-update.yml
@@ -12,7 +12,7 @@ jobs:
   flake-update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.branch }}
       - uses: DeterminateSystems/nix-installer-action@v22
diff --git a/.github/workflows/mldsa-bench.yml b/.github/workflows/mldsa-bench.yml
index 8ccc61813..9de3127b6 100644
--- a/.github/workflows/mldsa-bench.yml
+++ b/.github/workflows/mldsa-bench.yml
@@ -44,7 +44,7 @@ jobs:
         working-directory: libcrux-ml-dsa
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
diff --git a/.github/workflows/mldsa-build-test.yml b/.github/workflows/mldsa-build-test.yml
index 643f48205..dcc4fd163 100644
--- a/.github/workflows/mldsa-build-test.yml
+++ b/.github/workflows/mldsa-build-test.yml
@@ -41,7 +41,7 @@ jobs:
         working-directory: libcrux-ml-dsa
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
diff --git a/.github/workflows/mldsa-c.yml b/.github/workflows/mldsa-c.yml
index b6c932868..d47f098aa 100644
--- a/.github/workflows/mldsa-c.yml
+++ b/.github/workflows/mldsa-c.yml
@@ -22,7 +22,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v4
         id: changes
         with:
@@ -63,7 +63,7 @@ jobs:
         working-directory: libcrux-ml-dsa
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C (header only)
         run: |
@@ -90,7 +90,7 @@ jobs:
           name: header-only-c-extraction-ml-dsa
           path: ~/mldsa-c-extraction
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Diff Extraction
         run: |
diff --git a/.github/workflows/mldsa-hax.yml b/.github/workflows/mldsa-hax.yml
index 4a90a83cd..29e342b50 100644
--- a/.github/workflows/mldsa-hax.yml
+++ b/.github/workflows/mldsa-hax.yml
@@ -38,7 +38,7 @@ jobs:
       - get-hax-ref
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
@@ -62,7 +62,7 @@ jobs:
       - extract
     if: ${{ github.event_name != 'merge_group' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
@@ -84,8 +84,8 @@ jobs:
       - get-hax-ref
       - extract
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
         with:
           repository: cryspen/hax
           path: hax
diff --git a/.github/workflows/mlkem-bench.yml b/.github/workflows/mlkem-bench.yml
index 9d7d7799c..8ee575e47 100644
--- a/.github/workflows/mlkem-bench.yml
+++ b/.github/workflows/mlkem-bench.yml
@@ -43,7 +43,7 @@ jobs:
         working-directory: libcrux-ml-kem
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
diff --git a/.github/workflows/mlkem-build-test.yml b/.github/workflows/mlkem-build-test.yml
index 94f472d6d..1c4a29bf5 100644
--- a/.github/workflows/mlkem-build-test.yml
+++ b/.github/workflows/mlkem-build-test.yml
@@ -38,7 +38,7 @@ jobs:
         working-directory: libcrux-ml-kem
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: taiki-e/install-action@cargo-hack
 
       - name: Update dependencies
@@ -173,7 +173,7 @@ jobs:
         working-directory: libcrux-ml-kem
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
@@ -211,7 +211,7 @@ jobs:
         working-directory: libcrux-ml-kem
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: 🛠️ Setup Rust Nightly
         run: |
diff --git a/.github/workflows/mlkem-c.yml b/.github/workflows/mlkem-c.yml
index bbdf8491e..5b83e88f4 100644
--- a/.github/workflows/mlkem-c.yml
+++ b/.github/workflows/mlkem-c.yml
@@ -20,7 +20,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dorny/paths-filter@v4
         id: changes
         with:
@@ -65,7 +65,7 @@ jobs:
         working-directory: libcrux-ml-kem/extracts/c
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C
         run: |
@@ -91,7 +91,7 @@ jobs:
         working-directory: libcrux-ml-kem/extracts/c_header_only
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C (header only)
         run: |
@@ -117,7 +117,7 @@ jobs:
         working-directory: libcrux-ml-kem/extracts/cpp_header_only
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract C++
         run: |
@@ -149,7 +149,7 @@ jobs:
           name: c-ho-extraction-ml-kem
           path: ~/mlkem-c-extraction
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Diff Extraction C++
         run: |
diff --git a/.github/workflows/mlkem-hax.yml b/.github/workflows/mlkem-hax.yml
index 1f9b2eaea..4df80ad57 100644
--- a/.github/workflows/mlkem-hax.yml
+++ b/.github/workflows/mlkem-hax.yml
@@ -37,7 +37,7 @@ jobs:
       - get-hax-ref
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
@@ -62,7 +62,7 @@ jobs:
       - extract
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
@@ -83,8 +83,8 @@ jobs:
       - get-hax-ref
       - extract
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
         with:
           repository: cryspen/hax
           path: hax
diff --git a/.github/workflows/mlkem-s390x.yml b/.github/workflows/mlkem-s390x.yml
index 89faa3eba..1b614ea4f 100644
--- a/.github/workflows/mlkem-s390x.yml
+++ b/.github/workflows/mlkem-s390x.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build on ubuntu-22.04 s390x
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: uraimo/run-on-arch-action@v3
         name: Run
         id: runcmd
diff --git a/.github/workflows/platform-build-test.yml b/.github/workflows/platform-build-test.yml
index bf3153dd4..07f0b4b46 100644
--- a/.github/workflows/platform-build-test.yml
+++ b/.github/workflows/platform-build-test.yml
@@ -40,7 +40,7 @@ jobs:
         working-directory: crates/sys/platform
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Update dependencies
         run: cargo update
@@ -85,7 +85,7 @@ jobs:
         working-directory: crates/sys/platform
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Add no_std target
         run: rustup target add thumbv6m-none-eabi
diff --git a/.github/workflows/psq-build-test.yml b/.github/workflows/psq-build-test.yml
index 537166ade..2f53f4b45 100644
--- a/.github/workflows/psq-build-test.yml
+++ b/.github/workflows/psq-build-test.yml
@@ -37,7 +37,7 @@ jobs:
         working-directory: libcrux-psq
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
diff --git a/.github/workflows/secrets-build-test.yml b/.github/workflows/secrets-build-test.yml
index be6480901..b46355797 100644
--- a/.github/workflows/secrets-build-test.yml
+++ b/.github/workflows/secrets-build-test.yml
@@ -42,7 +42,7 @@ jobs:
         working-directory: crates/utils/secrets
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
@@ -165,7 +165,7 @@ jobs:
       CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER: 'valgrind --tool=memcheck --error-exitcode=1 --track-origins=yes'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install valgrind
         run: sudo apt-get update && sudo apt-get install -y valgrind
diff --git a/.github/workflows/sha3-hax.yml b/.github/workflows/sha3-hax.yml
index 2f782711e..f6becf5e5 100644
--- a/.github/workflows/sha3-hax.yml
+++ b/.github/workflows/sha3-hax.yml
@@ -37,7 +37,7 @@ jobs:
       - get-hax-ref
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
@@ -62,7 +62,7 @@ jobs:
       - extract-portable
     if: ${{ github.event_name != 'merge_group' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
@@ -84,7 +84,7 @@ jobs:
       - extract-portable
     if: ${{ github.event_name != 'merge_group' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hacspec/hax-actions@main
         with:
           hax_reference: ${{ github.event.inputs.hax_ref || needs.get-hax-ref.outputs.hax_ref }}
diff --git a/.github/workflows/sha3-spec-test.yml b/.github/workflows/sha3-spec-test.yml
index 91e1be183..6dd92719f 100644
--- a/.github/workflows/sha3-spec-test.yml
+++ b/.github/workflows/sha3-spec-test.yml
@@ -25,7 +25,7 @@ jobs:
         working-directory: specs/sha3
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: 🔨 Build
         run: cargo build --verbose
diff --git a/.github/workflows/traits-build.yml b/.github/workflows/traits-build.yml
index e1acf6a51..5135c46db 100644
--- a/.github/workflows/traits-build.yml
+++ b/.github/workflows/traits-build.yml
@@ -42,7 +42,7 @@ jobs:
         working-directory: traits
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: echo "RUST_TARGET_FLAG=" > $GITHUB_ENV
         if: ${{ matrix.bits == 64 }}
@@ -93,7 +93,7 @@ jobs:
         working-directory: traits
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Add no_std target
         run: rustup target add thumbv6m-none-eabi
diff --git a/.github/workflows/wasm-and-no-std-checks.yml b/.github/workflows/wasm-and-no-std-checks.yml
index 29e7c3205..0b5d28502 100644
--- a/.github/workflows/wasm-and-no-std-checks.yml
+++ b/.github/workflows/wasm-and-no-std-checks.yml
@@ -10,7 +10,7 @@ jobs:
   no-std-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install target
         run: rustup target add thumbv7em-none-eabihf
@@ -24,7 +24,7 @@ jobs:
   wasm-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install target
         run: rustup target add wasm32-unknown-unknown
diff --git a/.github/workflows/workspace-changelog.yml b/.github/workflows/workspace-changelog.yml
index 3b405b9d6..1b0664952 100644
--- a/.github/workflows/workspace-changelog.yml
+++ b/.github/workflows/workspace-changelog.yml
@@ -27,7 +27,7 @@ jobs:
 
       - name: Checkout full git history
         if: steps.skip_check.outputs.skip == 'false'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/workspace-checks.yml b/.github/workflows/workspace-checks.yml
index cda6faa9c..145515b68 100644
--- a/.github/workflows/workspace-checks.yml
+++ b/.github/workflows/workspace-checks.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: 🧹 Cargo fmt
         run: cargo fmt --all -- --check