diff --git a/.github/workflows/backend-fixtures-drift.yml b/.github/workflows/backend-fixtures-drift.yml
index 0de3c315..642f1b1d 100644
--- a/.github/workflows/backend-fixtures-drift.yml
+++ b/.github/workflows/backend-fixtures-drift.yml
@@ -40,7 +40,7 @@ jobs:
     name: Backend fixtures drift check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: scripts/sync-backend-fixtures.sh --check
         env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 271a645c..c320ccae 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
     # (backend#1009).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: scripts/sync-schema.sh --check
         run: ./scripts/sync-schema.sh --check
 
@@ -46,7 +46,7 @@ jobs:
     # closed when cosign is absent (RFC-0001 R8, backend#889).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: shellcheck + dash parse
         run: |
           sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck dash
@@ -61,10 +61,10 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -92,10 +92,10 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -192,10 +192,10 @@ jobs:
     # published between PRs). Bump deliberately.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -235,10 +235,10 @@ jobs:
             arch: arm64
             ext: .exe
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/chart-drift.yml b/.github/workflows/chart-drift.yml
index 78a41f02..ae566b31 100644
--- a/.github/workflows/chart-drift.yml
+++ b/.github/workflows/chart-drift.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout this CLI ref
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: cli
 
@@ -65,14 +65,14 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout tracebloc/client @ pinned ref
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: tracebloc/client
           ref: ${{ steps.pin.outputs.ref }}
           path: client
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: cli/go.mod
           cache: true
@@ -81,7 +81,7 @@ jobs:
       - name: Set up Helm
         # Pinned to the same version the client repo's own drift-checks job
         # uses, so both sides assert against an identical render.
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
         with:
           version: v3.15.4
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index e48d5c67..13189660 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -45,10 +45,10 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'e2e')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -89,10 +89,10 @@ jobs:
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'e2e')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -104,7 +104,7 @@ jobs:
         run: curl -sfL https://raw.githubusercontent.com/k3d-io/k3d/v5.7.4/install.sh | TAG=v5.7.4 bash
 
       - name: Install helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
         with:
           version: v3.15.4
 
diff --git a/.github/workflows/goldens-drift.yml b/.github/workflows/goldens-drift.yml
index 06791c98..d5423066 100644
--- a/.github/workflows/goldens-drift.yml
+++ b/.github/workflows/goldens-drift.yml
@@ -52,7 +52,7 @@ jobs:
     name: Validator goldens vs data-ingestors @ pin
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Resolve the data-ingestors pin
         id: pin
@@ -125,7 +125,7 @@ jobs:
 
       - name: Checkout tracebloc/data-ingestors @ pin
         if: steps.access.outputs.ok == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: tracebloc/data-ingestors
           ref: ${{ steps.pin.outputs.ref }}
@@ -138,7 +138,7 @@ jobs:
 
       - name: Set up Python
         if: steps.access.outputs.ok == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'   # matches data-ingestors' own CI
           cache: pip
diff --git a/.github/workflows/head-drift-canary.yml b/.github/workflows/head-drift-canary.yml
index 8d308733..d26edff5 100644
--- a/.github/workflows/head-drift-canary.yml
+++ b/.github/workflows/head-drift-canary.yml
@@ -47,7 +47,7 @@ jobs:
     name: Pin vs HEAD drift (advisory)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Resolve the data-ingestors pin
         id: pin
@@ -89,7 +89,7 @@ jobs:
           echo "use_pat=$use_pat" >> "$GITHUB_OUTPUT"
 
       - name: Checkout tracebloc/data-ingestors @ develop HEAD
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: tracebloc/data-ingestors
           ref: develop
@@ -159,7 +159,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'   # matches data-ingestors' own CI
           cache: pip
diff --git a/.github/workflows/install-path-persist.yml b/.github/workflows/install-path-persist.yml
index 8c734305..87b08ff9 100644
--- a/.github/workflows/install-path-persist.yml
+++ b/.github/workflows/install-path-persist.yml
@@ -59,13 +59,13 @@ jobs:
     steps:
       # 1. This PR's CLI source — we test THIS install.sh, not the released one.
       - name: Checkout this CLI PR
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: cli
 
       # 2. The fresh-shell harness from tracebloc/client (single source of truth).
       - name: Checkout the client path-persist harness
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: tracebloc/client
           ref: ${{ env.CLIENT_HARNESS_REF }}
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 118b4bbf..21adeb91 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -47,10 +47,10 @@ jobs:
     name: Mutation (${{ inputs.package }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b1e0b089..627d1bde 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -76,13 +76,13 @@ jobs:
             ext: .exe
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -169,7 +169,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
index 202acfcf..e467fb96 100644
--- a/.github/workflows/vulncheck.yml
+++ b/.github/workflows/vulncheck.yml
@@ -33,12 +33,12 @@ jobs:
     name: govulncheck (develop)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: develop
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true