diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba8cde1c..8835cb65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: shellcheck
         uses: ludeeus/action-shellcheck@2.0.0
@@ -58,7 +58,7 @@ jobs:
           /tmp/crust-lint lint-rules
 
       - name: Cache Go tools (govulncheck, nilaway)
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/go/bin
           key: go-tools-${{ runner.os }}-govulncheck-nilaway-v1
@@ -79,12 +79,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Cache pip (semgrep)
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cache/pip
           key: pip-semgrep-${{ runner.os }}-v1
@@ -118,7 +118,7 @@ jobs:
           mkdir -p /tmp/fuzz-cache
 
       - name: Restore fuzz corpus cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: /tmp/fuzz-cache
           key: fuzz-corpus-${{ runner.os }}-${{ github.sha }}
@@ -230,7 +230,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -272,7 +272,7 @@ jobs:
     needs: [lint]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -295,7 +295,7 @@ jobs:
     runs-on: macos-latest
     if: github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -375,7 +375,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         run: echo "Platform tests run on main only — skipping to reduce CI costs"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: github.ref == 'refs/heads/main'
 
       # setup-go must run before msys2/setup-msys2 so the toolchain is in PATH
@@ -417,7 +417,7 @@ jobs:
         if: github.ref != 'refs/heads/main'
         run: echo "FreeBSD tests run on main only — skipping to reduce CI costs"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: github.ref == 'refs/heads/main'
 
       - uses: vmactions/freebsd-vm@v1
@@ -453,7 +453,7 @@ jobs:
     needs: [lint]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -482,7 +482,7 @@ jobs:
     needs: [lint]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -572,7 +572,7 @@ jobs:
     needs: [lint]
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -686,7 +686,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build image
         run: docker build -t crust-test .
@@ -739,7 +739,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7d6954e6..d03ac2d4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,7 +17,7 @@ jobs:
     name: Analyze Go
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/cve-tracker.yml b/.github/workflows/cve-tracker.yml
index 017a00a2..2cdbf5a0 100644
--- a/.github/workflows/cve-tracker.yml
+++ b/.github/workflows/cve-tracker.yml
@@ -22,7 +22,7 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 947d177b..9fb127cb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,7 +37,7 @@ jobs:
             asset: crust-windows-amd64.exe
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -68,7 +68,7 @@ jobs:
     name: Build iOS xcframework
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -128,7 +128,7 @@ jobs:
           cat sha256sums.txt
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             dist/*