diff --git a/.github/workflows/auto-close-harvested.yml b/.github/workflows/auto-close-harvested.yml
index 1547ab96..0fd6c82b 100644
--- a/.github/workflows/auto-close-harvested.yml
+++ b/.github/workflows/auto-close-harvested.yml
@@ -38,7 +38,7 @@ jobs:
   close:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # We need at least the commits that this push introduced.
           # fetch-depth: 0 is the simplest correct option; the
diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index 57e8be11..6e395a11 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -28,7 +28,7 @@ jobs:
   tag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           # Prefer PAT so the resulting tag push triggers release.yml.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e2b277ab..ef3b047f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,9 +20,9 @@ jobs:
     name: Version drift
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
       - name: Check version drift
@@ -32,7 +32,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -62,7 +62,7 @@ jobs:
         # coverage CNB cannot provide.
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: runner.os != 'Linux'
       - uses: dtolnay/rust-toolchain@stable
         if: runner.os != 'Linux'
@@ -91,11 +91,11 @@ jobs:
       matrix:
         os: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || '["ubuntu-latest","macos-latest","windows-latest"]') }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: runner.os != 'Linux'
       - uses: dtolnay/rust-toolchain@stable
         if: runner.os != 'Linux'
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         if: runner.os != 'Linux'
         with:
           node-version: 20
@@ -118,7 +118,7 @@ jobs:
     if: github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install Linux system dependencies
         run: |
@@ -140,7 +140,7 @@ jobs:
     if: github.event_name == 'schedule'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Install Linux system dependencies
         if: runner.os == 'Linux'
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 630b309f..b9e1f645 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -76,7 +76,7 @@ jobs:
             artifact_name: codesmith-tui-windows-x64.exe
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -141,7 +141,7 @@ jobs:
           artifact=${{ matrix.artifact_name }}
           INFO
           echo "name=${{ matrix.artifact_name }}-${short_sha}" >> "${GITHUB_OUTPUT}"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.stage.outputs.name }}
           path: nightly/*
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b162afa8..dcf86e5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -62,7 +62,7 @@ jobs:
       source_ref: ${{ steps.release.outputs.source_ref }}
       sha: ${{ steps.release.outputs.sha }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Resolve release source
@@ -158,7 +158,7 @@ jobs:
             artifact_name: codesmith-tui-windows-x64.exe
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.resolve.outputs.source_ref }}
       - uses: dtolnay/rust-toolchain@stable
@@ -215,7 +215,7 @@ jobs:
             exit 1
           fi
           cp "${BIN_PATH}" "${{ matrix.artifact_name }}"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact_name }}
           path: ${{ matrix.artifact_name }}
@@ -225,10 +225,10 @@ jobs:
     if: ${{ !cancelled() && needs.build.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.resolve.outputs.source_ref }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: artifacts
           pattern: 'codesmith*'
@@ -315,7 +315,7 @@ jobs:
           cat "$MANIFEST"
 
       - name: Upload bundle artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: codesmith-bundles
           path: bundles/*
@@ -330,20 +330,20 @@ jobs:
       packages: write
     steps:
       - name: Checkout release source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ needs.resolve.outputs.source_ref }}
           path: source
       - name: Checkout release infrastructure
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: infra
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -354,7 +354,7 @@ jobs:
         run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ steps.image.outputs.name }}
@@ -370,7 +370,7 @@ jobs:
             type=raw,value=v${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         env:
           # The build record is useful in CI, but it is uploaded as a
           # `.dockerbuild` artifact. The release job intentionally downloads
@@ -396,7 +396,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: artifacts
           pattern: '*'
@@ -415,7 +415,7 @@ jobs:
             printf '%s  %s\n' "${hash}" "${base}" >> "${manifest}"
           done < <(find artifacts -type f ! -path 'artifacts/checksums/*' -print0 | sort -z)
           cat "${manifest}"
-      - uses: softprops/action-gh-release@v1
+      - uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ needs.resolve.outputs.tag }}
           files: artifacts/*/*
@@ -520,7 +520,7 @@ jobs:
           fi
       # Checkout main (not the tag) so the release-infra script is always
       # available, even for tags created before this workflow was added.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: steps.homebrew-token.outputs.available == 'true'
         with:
           ref: main
diff --git a/.github/workflows/spam-lockdown.yml b/.github/workflows/spam-lockdown.yml
index 17f11bf0..1142c014 100644
--- a/.github/workflows/spam-lockdown.yml
+++ b/.github/workflows/spam-lockdown.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Auto-close spam patterns from new accounts
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 75535aa7..d89a1175 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v11
         with:
           days-before-stale: 14
           days-before-close: 7
diff --git a/.github/workflows/sync-cnb.yml b/.github/workflows/sync-cnb.yml
index 148a44ea..29c1c624 100644
--- a/.github/workflows/sync-cnb.yml
+++ b/.github/workflows/sync-cnb.yml
@@ -49,7 +49,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 4c7ad25b..3b47b257 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Auto-label by title and body
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index d9d22192..2006721b 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -21,8 +21,8 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: 'npm'