diff --git a/.github/workflows/analyzers.yml b/.github/workflows/analyzers.yml
index 8f2494450..d79a3047c 100644
--- a/.github/workflows/analyzers.yml
+++ b/.github/workflows/analyzers.yml
@@ -44,7 +44,7 @@ jobs:
         run: make scs_lint
 
   native:
-    name: ${{ matrix.analyzer }} (includes KUnit sources)
+    name: ${{ matrix.analyzer }}
     needs: script-tests
     runs-on: ubuntu-24.04
     timeout-minutes: 45
@@ -56,8 +56,7 @@ jobs:
           - smatch
           - checkpatch
           - coccicheck
-          # Supported by the runner; enable after reviewing native coverage.
-          # - cppcheck
+          - cppcheck
     steps:
       - uses: actions/checkout@v7
         with:
diff --git a/.github/workflows/ginkgo.yml b/.github/workflows/ginkgo.yml
index 669b1b4d7..18fc3ea4f 100644
--- a/.github/workflows/ginkgo.yml
+++ b/.github/workflows/ginkgo.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 220
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           # Compare the whole PR against its merge base, including fork PRs.
@@ -57,7 +57,7 @@ jobs:
             "$RUNNER_TEMP/ginkgo-results" --timeout 10000 --ginkgo-label "$GINKGO_LABEL"
       - name: Save build logs, reports and serial consoles
         if: always() && steps.changes.outputs.run == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ginkgo-results
           retention-days: 7
diff --git a/.github/workflows/kunit.yml b/.github/workflows/kunit.yml
index feccef87e..7438cacf9 100644
--- a/.github/workflows/kunit.yml
+++ b/.github/workflows/kunit.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           # Compare the whole PR against its merge base, including fork PRs.
@@ -59,7 +59,7 @@ jobs:
             "$RUNNER_TEMP/kunit-results" --timeout 1200
       - name: Save build and runtime evidence
         if: always() && steps.changes.outputs.run == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: kunit-results
           retention-days: 7
diff --git a/scripts/README.md b/scripts/README.md
index 818a6dbd9..6c4f0d100 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -272,12 +272,10 @@ returns 2 (Make maps both to 2). Empty input is a skip.
 
 The [workflow](../.github/workflows/analyzers.yml) runs on pushes to `master`
 and manual dispatch. Separate jobs run `make sparse`, `make smatch`,
-`make checkpatch` and `make coccicheck`, including KUnit sources.
+`make checkpatch`, `make coccicheck` and `make cppcheck`, including KUnit sources.
 `Analyzer script tests` runs `make lint-test`; it does not execute SCST
 tests. A parallel `SCST code style` job runs `make scs_lint` without a kernel
 build. The container jobs retain reports from `.cache/lint/` for seven days.
-The runner and image also support Cppcheck; its matrix entry remains
-commented out.
 
 CI fails on findings remaining after policy exceptions, just like local Make
 targets. The native-analyzer runner returns 1 for completed analysis with