diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 57da52b..b13f596 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -36,11 +36,11 @@ jobs:
     pip-audit:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: "3.13"
                   cache: pip
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 23ba52b..2cb395e 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -79,7 +79,7 @@ jobs:
             # all tags. Default shallow clone hides everything but HEAD.
             # ref: a dispatch with a tag input builds THAT tag's tree; a tag
             # push or bare dispatch checks out the triggering ref as before.
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   ref: ${{ inputs.tag || github.ref }}
@@ -106,7 +106,7 @@ jobs:
                   echo "→ release tag: '${tag:-<none — edge build>}' (prerelease: $prerelease)"
 
             - name: Set up Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@v7
               with:
                   python-version: "3.12"
 
@@ -140,13 +140,13 @@ jobs:
                   fi
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
+              uses: docker/setup-qemu-action@v4
 
             - name: Set up Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@v4
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@v3
+              uses: docker/login-action@v4
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -161,7 +161,7 @@ jobs:
             # this workflow may assign :latest except promote.
             - name: Derive staging tag + OCI labels
               id: meta
-              uses: docker/metadata-action@v5
+              uses: docker/metadata-action@v6
               with:
                   images: ${{ env.IMAGE }}
                   flavor: |
@@ -187,7 +187,7 @@ jobs:
             # static/dist/ ships. Doing it here also keeps it out of the
             # per-architecture builds — the bundle is plain JS, arch-agnostic.
             - name: Set up Node
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v7
               with:
                   node-version: "20"
 
@@ -198,7 +198,7 @@ jobs:
 
             - name: Build and push
               id: build
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@v7
               with:
                   context: .
                   platforms: linux/amd64,linux/arm64
@@ -284,7 +284,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Log in to Docker Hub
-              uses: docker/login-action@v3
+              uses: docker/login-action@v4
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
                   password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/dockerhub-readme.yml b/.github/workflows/dockerhub-readme.yml
index 41fc38d..2c1f037 100644
--- a/.github/workflows/dockerhub-readme.yml
+++ b/.github/workflows/dockerhub-readme.yml
@@ -59,7 +59,7 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             # README.dockerhub.md is generated by docs-ai/readme/compose.sh
             # from gitignored section sources. If someone deletes it, the
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e2b993d..cf6268e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -33,14 +33,14 @@ jobs:
     build:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Configure Pages
-              uses: actions/configure-pages@v5
+              uses: actions/configure-pages@v6
               with:
                   enablement: true
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: "3.12"
 
@@ -51,7 +51,7 @@ jobs:
               run: mkdocs build --strict
 
             - name: Upload Pages artifact
-              uses: actions/upload-pages-artifact@v3
+              uses: actions/upload-pages-artifact@v5
               with:
                   path: site/
 
@@ -64,4 +64,4 @@ jobs:
         steps:
             - name: Deploy to GitHub Pages
               id: deployment
-              uses: actions/deploy-pages@v4
+              uses: actions/deploy-pages@v5
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index 9eeab9b..53c5de8 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -33,12 +33,12 @@ jobs:
         steps:
             # fetch-depth: 0 so setuptools-scm can `git describe` against
             # all tags. Default shallow clone hides everything but HEAD.
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
             - name: Set up Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@v7
               with:
                   python-version: "3.12"
 
@@ -47,7 +47,7 @@ jobs:
             # gitignored, so it must be generated here — package-data globs the
             # filesystem, so a present static/dist/ lands in the wheel.
             - name: Set up Node
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v7
               with:
                   node-version: "20"
 
@@ -138,12 +138,12 @@ jobs:
                   echo
                   echo "✓ /health responded from the installed wheel"
 
-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@v7
               with:
                   name: dist
                   path: dist/
 
-            - uses: actions/upload-artifact@v4
+            - uses: actions/upload-artifact@v7
               with:
                   name: third-party-licenses
                   path: third-party-licenses.md
@@ -157,7 +157,7 @@ jobs:
         permissions:
             id-token: write # OIDC token for Trusted Publishing
         steps:
-            - uses: actions/download-artifact@v4
+            - uses: actions/download-artifact@v8
               with:
                   name: dist
                   path: dist/
@@ -178,7 +178,7 @@ jobs:
         permissions:
             contents: write
         steps:
-            - uses: actions/download-artifact@v4
+            - uses: actions/download-artifact@v8
               with:
                   name: dist
                   path: dist/
diff --git a/.github/workflows/release-features.yml b/.github/workflows/release-features.yml
index 03f4083..f285a1e 100644
--- a/.github/workflows/release-features.yml
+++ b/.github/workflows/release-features.yml
@@ -23,7 +23,7 @@ jobs:
             contents: read
             packages: write
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Bundle painapple source into Feature
               run: tools/bundle-feature-source.sh --feature-only
diff --git a/.github/workflows/test-features.yml b/.github/workflows/test-features.yml
index fa3f059..06ce746 100644
--- a/.github/workflows/test-features.yml
+++ b/.github/workflows/test-features.yml
@@ -21,7 +21,7 @@ jobs:
                     - mcr.microsoft.com/devcontainers/base:ubuntu
                     - debian:bookworm-slim
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
             - name: Install devcontainers CLI
               run: npm install -g @devcontainers/cli
             - name: Test ${{ matrix.feature }} on ${{ matrix.baseImage }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 10a207d..eeac39e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -67,12 +67,12 @@ jobs:
             # tags rather than falling back to 0.1.devN.
             # ref is empty for every trigger except a workflow_call that
             # passes one — checkout treats empty as "the triggering ref".
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
                   ref: ${{ inputs.ref }}
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: ${{ matrix.python-version }}
                   cache: pip
diff --git a/.github/workflows/windows-smoke.yml b/.github/workflows/windows-smoke.yml
index 3f460f6..aa07f41 100644
--- a/.github/workflows/windows-smoke.yml
+++ b/.github/workflows/windows-smoke.yml
@@ -29,11 +29,11 @@ jobs:
             # fetch-depth: 0 so setuptools-scm can resolve a version from
             # tags; without it the build falls back to 0.1.devN, which is
             # fine for a smoke test but noisy in logs.
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
 
-            - uses: actions/setup-python@v5
+            - uses: actions/setup-python@v7
               with:
                   python-version: ${{ matrix.python-version }}