diff --git a/.github/workflows/brief-format-check.yml b/.github/workflows/brief-format-check.yml
index f17de679..7fd6633a 100644
--- a/.github/workflows/brief-format-check.yml
+++ b/.github/workflows/brief-format-check.yml
@@ -41,10 +41,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f92fd94a..6a498380 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,16 +17,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: false
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 20
       - run: npm ci
       - run: npm run build-prod
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           path: static/index.html
           retention-days: 1
@@ -36,11 +36,11 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: false
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 20
       - run: npm ci
@@ -49,7 +49,7 @@ jobs:
         run: npm run verify:contracts
       - name: Enforce checked-in coverage ratchet
         run: node scripts/check-coverage-ratchet.mjs
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-summary
@@ -61,8 +61,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"
@@ -74,8 +74,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"
@@ -87,8 +87,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"
@@ -101,8 +101,8 @@ jobs:
     timeout-minutes: 30
     needs: [build]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: "npm"
diff --git a/.github/workflows/db-migrate.yml b/.github/workflows/db-migrate.yml
index d75f2002..c43447a9 100644
--- a/.github/workflows/db-migrate.yml
+++ b/.github/workflows/db-migrate.yml
@@ -33,7 +33,7 @@ jobs:
           --health-retries 10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Apply schema
         env:
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 14a715b1..44c19d41 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index da9157a0..4c891e9e 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -20,13 +20,13 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Upload launch stub artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: pages-stub
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8ba821ab..bd6313b7 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -33,7 +33,7 @@ jobs:
       SUBDOMAIN: ${{ inputs.target_subdomain }}
       FQDN: ${{ format('{0}.{1}', inputs.target_subdomain, vars.DOMAIN) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Validate repository deployment contract
         run: node scripts/check-deploy-contract.mjs
@@ -49,7 +49,7 @@ jobs:
 
       - name: Log in to GitHub Container Registry
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ vars.GHCR_USERNAME }}
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index ba1130ee..94837a22 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
@@ -42,7 +42,7 @@ jobs:
           # Omit an empty variable so Playwright starts and probes the local stack.
           E2E_BASE_URL: ${{ vars.E2E_BASE_URL }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report
diff --git a/.github/workflows/pr-author.yml b/.github/workflows/pr-author.yml
index 3302f5c6..3cc32dc7 100644
--- a/.github/workflows/pr-author.yml
+++ b/.github/workflows/pr-author.yml
@@ -13,4 +13,4 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: toshimaru/auto-author-assign@7e15cd70c245ad136377c3fab3479815df10d844
+      - uses: toshimaru/auto-author-assign@da4dc1570b78bb0e1693ff703cd7077c6c2596f0
diff --git a/.github/workflows/pr-description.yml b/.github/workflows/pr-description.yml
index 7ad8603d..f249d67d 100644
--- a/.github/workflows/pr-description.yml
+++ b/.github/workflows/pr-description.yml
@@ -24,11 +24,11 @@ jobs:
     steps:
       - name: Checkout trusted base validator
         if: github.event_name == 'pull_request'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             if (context.eventName === 'merge_group') {
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             if (context.eventName === 'merge_group') {
diff --git a/.github/workflows/pr-stale.yml b/.github/workflows/pr-stale.yml
index 27b35f9e..c2923646 100644
--- a/.github/workflows/pr-stale.yml
+++ b/.github/workflows/pr-stale.yml
@@ -10,7 +10,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/stale@8f717f0dfca33b78d3c933452e42558e4456c8e7
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629
         with:
           days-before-pr-close: 14
           days-before-pr-stale: 14
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 7fb10cdc..5a844c1d 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -36,7 +36,7 @@ jobs:
       SUBDOMAIN: ${{ inputs.target_subdomain }}
       FQDN: ${{ inputs.target_subdomain == 'main' && vars.DOMAIN || format('{0}.{1}', inputs.target_subdomain, vars.DOMAIN) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Validate immutable staging evidence
         env:
@@ -60,7 +60,7 @@ jobs:
 
       - name: Log in to GitHub Container Registry
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ vars.GHCR_USERNAME }}
diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml
index 0fac626f..26ddb579 100644
--- a/.github/workflows/semantic-release.yml
+++ b/.github/workflows/semantic-release.yml
@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24.14.0
           cache: npm
@@ -38,12 +38,12 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24.14.0
           cache: npm