diff --git a/.github/workflows/ci-typescript.yml b/.github/workflows/ci-typescript.yml
index 2c3cf25..64637a3 100644
--- a/.github/workflows/ci-typescript.yml
+++ b/.github/workflows/ci-typescript.yml
@@ -23,8 +23,8 @@ jobs:
       run:
         working-directory: sdk/typescript
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24be574..4a6e43e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
   rust:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -28,8 +28,8 @@ jobs:
     # or daemon needed — the analyzer runs on synthetic event lists.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - name: analyze.py unit tests
@@ -48,8 +48,8 @@ jobs:
     # and the _send wire protocol against an in-process socket server.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - name: install + pytest
@@ -69,8 +69,10 @@ jobs:
           # Deliberately tracks the latest compatible 1.x as an early warning.
           - 'mcp>=1.2,<2'
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@v7
+      # setup-uv stopped publishing floating major tags after v7, so this
+      # one is pinned to an exact release while the rest track majors.
+      - uses: astral-sh/setup-uv@v9.0.0
       - name: stdio handshake
         run: >-
           uv run --isolated --no-project
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 1742d45..4632cb6 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -18,8 +18,8 @@ jobs:
       run:
         working-directory: sdk/typescript
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/publish-pypi-mcp.yml b/.github/workflows/publish-pypi-mcp.yml
index 52b9b2e..c78b84e 100644
--- a/.github/workflows/publish-pypi-mcp.yml
+++ b/.github/workflows/publish-pypi-mcp.yml
@@ -33,9 +33,9 @@ jobs:
       id-token: write   # OIDC for Trusted Publishers
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index efb9773..c78f953 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -29,9 +29,9 @@ jobs:
       id-token: write   # OIDC for Trusted Publishers
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2eee753..11ab321 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
     name: build binaries (x86_64-linux)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -61,7 +61,7 @@ jobs:
           sha256sum forkd-*.tar.gz > SHA256SUMS
 
       - name: Create / update GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           # Prefer the PAT so the `release: published` event fires
           # downstream workflows (publish-pypi.yml). Fall back to
@@ -80,19 +80,19 @@ jobs:
     name: build + push Docker image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build + push controller image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
@@ -123,7 +123,7 @@ jobs:
     # Python SDK publish for `v*` tags on the main package.
     if: startsWith(github.ref_name, 'v')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Dispatch publish-pypi.yml
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}