diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index b279bfc3..9857b0d2 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -82,7 +82,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       # ── 2. Checkout with full tag history (needed for forward-only check) ─
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         if: steps.marker.outputs.found == 'true'
         with:
           fetch-depth: 0
@@ -123,7 +123,7 @@ jobs:
       # ── 4. Run the bump script ────────────────────────────────────────
       - name: Set up Python
         if: steps.marker.outputs.found == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 
@@ -224,7 +224,7 @@ jobs:
           echo "Found --patch marker."
           echo "found=true" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         if: steps.marker.outputs.found == 'true'
 
       # Build the patch bullet:
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 8ca057f4..4b61fca3 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -54,13 +54,13 @@ jobs:
           echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
           echo "tag_ref=refs/tags/v$VERSION" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         if: github.event_name == 'workflow_dispatch'
         with:
           ref: ${{ steps.requested_version.outputs.tag_ref }}
           fetch-depth: 0
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         if: github.event_name == 'workflow_run'
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index c3fb19d9..bbb354fd 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -31,17 +31,17 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           # Serve from the repository root so index.html and docs/ are both reachable.
           path: '.'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/patch-release.yml b/.github/workflows/patch-release.yml
index 1cd6bcb5..ef15b05c 100644
--- a/.github/workflows/patch-release.yml
+++ b/.github/workflows/patch-release.yml
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Preflight checks
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -126,7 +126,7 @@ jobs:
     name: Build ${{ matrix.artifact }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -144,7 +144,7 @@ jobs:
         run: cargo install cross --git https://github.com/cross-rs/cross
 
       - name: Cache cargo registry & build
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
@@ -194,7 +194,7 @@ jobs:
              "stage/${{ matrix.artifact }}/coven-code${{ matrix.ext }}"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ${{ matrix.artifact }}
           path: stage/${{ matrix.artifact }}/coven-code${{ matrix.ext }}
@@ -205,12 +205,12 @@ jobs:
     runs-on: ubuntu-latest
     name: Replace release assets
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           path: artifacts
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4e5d927f..e9cb2270 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Preflight checks
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -100,7 +100,7 @@ jobs:
     name: Build ${{ matrix.artifact }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
 
@@ -123,7 +123,7 @@ jobs:
         run: cargo install cross --git https://github.com/cross-rs/cross
 
       - name: Cache cargo registry & build
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
@@ -177,7 +177,7 @@ jobs:
              "stage/${{ matrix.artifact }}/coven-code${{ matrix.ext }}"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ${{ matrix.artifact }}
           path: stage/${{ matrix.artifact }}/coven-code${{ matrix.ext }}
@@ -189,13 +189,13 @@ jobs:
     name: Create Release
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           path: artifacts
 
@@ -371,7 +371,7 @@ jobs:
           cat release-notes.md
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ env.RELEASE_VERSION }}
           target_commitish: ${{ github.sha }}