diff --git a/.github/workflows/android-visual.yml b/.github/workflows/android-visual.yml
index cc491ef..b3cc457 100644
--- a/.github/workflows/android-visual.yml
+++ b/.github/workflows/android-visual.yml
@@ -24,11 +24,11 @@ jobs:
       PAM_NATIVE_COMMIT: dd486195a047471665d54fe9feb76b11a1391d87
       PAM_PRODUCT_APPLICATION_ID: app.pam.productvisual
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Check out the pinned PAM Native SDK
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: ${{ env.PAM_NATIVE_COMMIT }}
@@ -40,7 +40,7 @@ jobs:
           java-version: '17'
           cache: gradle
       - uses: android-actions/setup-android@v4
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           targets: x86_64-linux-android
       - uses: shivammathur/setup-php@v2
@@ -135,7 +135,7 @@ jobs:
           mkdir -p "${fixture}/artifacts"
           adb logcat -d -t 2000 2>/dev/null \
             >"${fixture}/artifacts/android-logcat.txt" || true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pam-product-android-visual-${{ github.sha }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b707bd5..271fc33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,24 +14,24 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Check out the pinned PAM Native SDK
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: dd486195a047471665d54fe9feb76b11a1391d87
           path: pam-native
           persist-credentials: false
       - name: Check out the pinned PAM Native plugin kit
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-plugin-kit
           ref: 4f00e4b4b84bd0d70f52cc97369d743b37d8ea0a
           path: ecosystem/pam-native-plugin-kit
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy,rustfmt
       - uses: shivammathur/setup-php@v2
@@ -188,7 +188,7 @@ jobs:
               compatibility.json schema.json verification.json >SHA256SUMS
             sha256sum --check --strict SHA256SUMS
           )
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-cli-catalog-contract-${{ github.sha }}
           path: artifacts/cli-catalog/
@@ -300,7 +300,7 @@ jobs:
               support-runtime.json support-manager.json >SHA256SUMS
             sha256sum --check --strict SHA256SUMS
           )
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-doctor-contract-${{ github.sha }}
           path: artifacts/doctor/
diff --git a/.github/workflows/composer-package-release.yml b/.github/workflows/composer-package-release.yml
index bb6aba7..bf7ce1f 100644
--- a/.github/workflows/composer-package-release.yml
+++ b/.github/workflows/composer-package-release.yml
@@ -37,7 +37,7 @@ jobs:
       matrix: ${{ steps.package.outputs.matrix }}
       source_sha: ${{ steps.source.outputs.sha }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -80,7 +80,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.prepare.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -123,7 +123,7 @@ jobs:
             --arg composerLockSha256 "${lock_sha}" \
             '{schemaVersion: 1, package: $package, tag: $tag, sourceSha: $sourceSha, splitSha: $splitSha, composerJsonSha256: $composerJsonSha256, composerLockSha256: (if $composerLockSha256 == "" then null else $composerLockSha256 end)}' \
             > independent-package-release.json
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: composer-package-${{ matrix.repository }}-${{ inputs.package_tag }}
           path: independent-package-release.json
@@ -141,7 +141,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.prepare.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/composer-packages.yml b/.github/workflows/composer-packages.yml
index d41cd4b..549dd35 100644
--- a/.github/workflows/composer-packages.yml
+++ b/.github/workflows/composer-packages.yml
@@ -31,7 +31,7 @@ jobs:
       matrix: ${{ steps.packages.outputs.matrix }}
       release_tag: ${{ steps.release.outputs.tag }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -72,7 +72,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.prepare.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -104,7 +104,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.prepare.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/desktop-linux-distribution.yml b/.github/workflows/desktop-linux-distribution.yml
index 7331623..964a680 100644
--- a/.github/workflows/desktop-linux-distribution.yml
+++ b/.github/workflows/desktop-linux-distribution.yml
@@ -69,16 +69,16 @@ jobs:
       PAM_BASELINE_TAG: ${{ inputs.desktop_baseline_tag }}
       PAM_EXPECTED_EVIDENCE_IDENTITY: ${{ inputs.evidence_key_identity }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-desktop
           ref: ${{ inputs.desktop_current_ref }}
           path: desktop-current-source
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-desktop
           ref: ${{ inputs.desktop_baseline_ref }}
@@ -300,7 +300,7 @@ jobs:
           test "$(jq -r '.packageCode' certification/verification.json)" = 1
           test "$(jq -r '.platformVerificationSha256' certification/verification.json)" = null
           test "$(jq -r '.signingIdentitySha256' certification/verification.json)" = "${PAM_EXPECTED_EVIDENCE_IDENTITY}"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-desktop-linux-host-distribution-${{ inputs.desktop_current_tag }}-${{ github.sha }}
           path: certification/
diff --git a/.github/workflows/desktop-visual.yml b/.github/workflows/desktop-visual.yml
index 5b744db..1742e35 100644
--- a/.github/workflows/desktop-visual.yml
+++ b/.github/workflows/desktop-visual.yml
@@ -25,17 +25,17 @@ jobs:
       PAM_DESKTOP_COMMIT: c89ea15a78eb3509a8611e42302c867c3c09bbbf
       PAM_DESKTOP_BINARY: ${{ github.workspace }}/pam-desktop/target/debug/pam-desktop
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Check out the pinned PAM Desktop host
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-desktop
           ref: ${{ env.PAM_DESKTOP_COMMIT }}
           path: pam-desktop
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
@@ -136,7 +136,7 @@ jobs:
           if test -n "${PAM_XVFB_PID:-}"; then
             kill -TERM "${PAM_XVFB_PID}" 2>/dev/null || true
           fi
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pam-product-desktop-visual-${{ github.sha }}
diff --git a/.github/workflows/ecosystem-compatibility.yml b/.github/workflows/ecosystem-compatibility.yml
index f48586d..9e34c08 100644
--- a/.github/workflows/ecosystem-compatibility.yml
+++ b/.github/workflows/ecosystem-compatibility.yml
@@ -35,7 +35,7 @@ jobs:
     outputs:
       matrix: ${{ steps.catalog.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam
           ref: ${{ inputs.pam_ref != '' && inputs.pam_ref || (github.repository == 'push-in/pam' && github.sha || 'main') }}
@@ -63,19 +63,19 @@ jobs:
         include: ${{ fromJSON(needs.inventory.outputs.matrix) }}
     name: ${{ matrix.package.repository }} / PHP ${{ matrix.php }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam
           ref: ${{ inputs.pam_ref != '' && inputs.pam_ref || (github.repository == 'push-in/pam' && github.sha || 'main') }}
           path: pam
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/${{ matrix.package.repository }}
           ref: ${{ github.event.repository.name == matrix.package.repository && github.ref_type == 'tag' && github.ref || 'main' }}
           path: package
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         if: >-
           github.event.repository.name == 'pam-native-php' &&
           github.ref_type == 'tag' &&
@@ -250,7 +250,7 @@ jobs:
                 {graphCode: 2, lockSha256: $lowestLockSha256}
               ]
             }' >"evidence/${REPOSITORY}-php${PHP_SERIES/./}.json"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ecosystem-result-${{ matrix.package.repository }}-php${{ matrix.php }}
           path: evidence/*.json
@@ -263,12 +263,12 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam
           ref: ${{ inputs.pam_ref != '' && inputs.pam_ref || (github.repository == 'push-in/pam' && github.sha || 'main') }}
           persist-credentials: false
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: ecosystem-result-*
           path: evidence/results
@@ -277,7 +277,7 @@ jobs:
         run: >-
           scripts/ecosystem-compatibility.py evidence evidence/results
           evidence/ecosystem-compatibility.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ecosystem-compatibility-evidence
           path: evidence/ecosystem-compatibility.json
diff --git a/.github/workflows/evidence.yml b/.github/workflows/evidence.yml
index c3d8956..9853cda 100644
--- a/.github/workflows/evidence.yml
+++ b/.github/workflows/evidence.yml
@@ -52,23 +52,23 @@ jobs:
       PAM_RECOVERY_MAX_READINESS_P95_MILLIS: '150'
       PAM_RECOVERY_MAX_RSS_GROWTH_BYTES: '16777216'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Check out the pinned PAM Native SDK
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: dd486195a047471665d54fe9feb76b11a1391d87
           path: pam-native
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
           coverage: none
           tools: composer:v2
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         if: env.PAM_EVIDENCE_SUITE_ID == '6'
         with:
           node-version: '22.22.0'
@@ -132,7 +132,7 @@ jobs:
           esac
           php benchmarks/octane/evidence-manifest.php \
             "${results}" "${PAM_EVIDENCE_SUITE_ID}" --verify
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pam-evidence-suite-${{ env.PAM_EVIDENCE_SUITE_ID }}-${{ github.sha }}
diff --git a/.github/workflows/ios-native.yml b/.github/workflows/ios-native.yml
index 8d49d59..bd5c014 100644
--- a/.github/workflows/ios-native.yml
+++ b/.github/workflows/ios-native.yml
@@ -49,52 +49,52 @@ jobs:
       PAM_FOUNDATION_EXTENSIONS: ${{ matrix.foundation_extensions }}
       PAM_EXTENSIONKIT_EXTENSIONS: ${{ matrix.extensionkit_extensions }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Check out the pinned PAM Native SDK
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: dd486195a047471665d54fe9feb76b11a1391d87
           path: pam-native
           persist-credentials: false
       - name: Check out the iOS capability certification plugins
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-share-extension
           ref: e3098097196ba2cfa3c47654ef5b69bfd9be3180
           path: certification-plugins/share-extension
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-health
           ref: 4f93f2d06ba27b949bb031700ed5e94c59281a9e
           path: certification-plugins/health
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-media
           ref: 35d9e16514969c1352977a9af767e59e449608f0
           path: certification-plugins/media
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-widgets
           ref: 3df0454e083b0d3591c960b423ea657a6dd547e7
           path: certification-plugins/widgets
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-intents
           ref: c4712fe103437c3244f72859724fe9b6db3d3459
           path: certification-plugins/intents
           persist-credentials: false
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-native-live-activities
           ref: dee003b1906b9df77b0b510b5b87922d298c488a
           path: certification-plugins/live-activities
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios
       - uses: Swatinem/rust-cache@v2
@@ -107,7 +107,7 @@ jobs:
           coverage: none
       - name: Restore verified PHP/XCFramework runtime
         id: runtime-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             runtime/ios/${{ matrix.runtime_id }}
@@ -125,7 +125,7 @@ jobs:
           test -f "runtime/ios/${{ matrix.runtime_id }}/runtime.json"
       - name: Save verified PHP/XCFramework runtime immediately
         if: steps.runtime-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           path: |
             runtime/ios/${{ matrix.runtime_id }}
@@ -310,7 +310,7 @@ jobs:
           fi
           ! grep -E 'Pam Native failed to start|PHP (fatal|parse) error' \
             "${RUNNER_TEMP}/pam-ios-fixture/simulator.log"
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pam-native-ios-generated-host-${{ matrix.profile }}
diff --git a/.github/workflows/laravel-compatibility.yml b/.github/workflows/laravel-compatibility.yml
index 7e5f276..46ea0ba 100644
--- a/.github/workflows/laravel-compatibility.yml
+++ b/.github/workflows/laravel-compatibility.yml
@@ -61,8 +61,8 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
diff --git a/.github/workflows/observability.yml b/.github/workflows/observability.yml
index bda74a1..e597953 100644
--- a/.github/workflows/observability.yml
+++ b/.github/workflows/observability.yml
@@ -33,10 +33,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
@@ -76,7 +76,7 @@ jobs:
         run: scripts/certify-otlp.sh
       - name: Verify bounded evidence
         run: python3 scripts/otlp-evidence.py artifacts/otlp 1 --verify
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: pam-otlp-collector-${{ github.sha }}
diff --git a/.github/workflows/octane-release-smoke.yml b/.github/workflows/octane-release-smoke.yml
index 92f293e..ce66a64 100644
--- a/.github/workflows/octane-release-smoke.yml
+++ b/.github/workflows/octane-release-smoke.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Validate requested versions
diff --git a/.github/workflows/octane.yml b/.github/workflows/octane.yml
index 71f5d00..34ee348 100644
--- a/.github/workflows/octane.yml
+++ b/.github/workflows/octane.yml
@@ -70,7 +70,7 @@ jobs:
             phpunit: '^13.0'
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
@@ -97,8 +97,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
diff --git a/.github/workflows/product-visual.yml b/.github/workflows/product-visual.yml
index e308567..7ed30bf 100644
--- a/.github/workflows/product-visual.yml
+++ b/.github/workflows/product-visual.yml
@@ -27,14 +27,14 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: pam-product-android-visual-${{ github.sha }}
           path: visual/android
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: pam-product-desktop-visual-${{ github.sha }}
           path: visual/desktop
@@ -102,7 +102,7 @@ jobs:
               | xargs -0 sha256sum >SHA256SUMS
             sha256sum --check --strict SHA256SUMS
           )
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-product-visual-certified-${{ github.sha }}
           path: product-visual-evidence/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 775599b..4d2a23f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
           fetch-depth: 0
@@ -60,14 +60,14 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
       - name: Validate tag matches the runtime version
         env:
           PAM_RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}
         run: scripts/package-release.sh validate-tag "${PAM_RELEASE_TAG}"
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: dd486195a047471665d54fe9feb76b11a1391d87
@@ -76,7 +76,7 @@ jobs:
       - uses: android-actions/setup-android@v4
       - name: Install pinned Android NDK
         run: sdkmanager "ndk;27.1.12297006"
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           targets: aarch64-linux-android,x86_64-linux-android
       - uses: Swatinem/rust-cache@v2
@@ -101,7 +101,7 @@ jobs:
         if: github.event.repository.visibility == 'public'
         with:
           subject-path: dist/pam-android-runtime.tar.gz
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-android-runtime
           path: |
@@ -134,7 +134,7 @@ jobs:
           DEBIAN_FRONTEND=noninteractive apt-get install -y \
             ca-certificates curl git gnupg software-properties-common sudo \
             unzip zstd
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
       - name: Validate tag matches the runtime version
@@ -142,13 +142,13 @@ jobs:
           PAM_RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}
         run: scripts/package-release.sh validate-tag "${PAM_RELEASE_TAG}"
       - name: Check out the pinned PAM Native SDK
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: dd486195a047471665d54fe9feb76b11a1391d87
           path: pam-native
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy,rustfmt
       - uses: shivammathur/setup-php@v2
@@ -237,7 +237,7 @@ jobs:
         uses: actions/attest@v4
         with:
           subject-path: dist/*.tar.gz
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-${{ matrix.target }}
           path: |
@@ -263,7 +263,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
       - name: Validate tag matches the runtime version
@@ -271,13 +271,13 @@ jobs:
           PAM_RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref_name }}
         run: scripts/package-release.sh validate-tag "${PAM_RELEASE_TAG}"
       - name: Check out the pinned PAM Native SDK
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           repository: push-in/pam-native
           ref: dd486195a047471665d54fe9feb76b11a1391d87
           path: pam-native
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios
       - uses: Swatinem/rust-cache@v2
@@ -329,7 +329,7 @@ jobs:
         uses: actions/attest@v4
         with:
           subject-path: dist/*.tar.gz
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: pam-${{ matrix.target }}
           path: |
@@ -361,28 +361,28 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
           persist-credentials: false
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: pam-*
           path: dist
           merge-multiple: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: certification-runtime-distribution-linux-x86_64-${{ github.sha }}
           path: runtime-distribution-certification/linux-x86_64
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: certification-runtime-distribution-linux-aarch64-${{ github.sha }}
           path: runtime-distribution-certification/linux-aarch64
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: certification-runtime-distribution-macos-x86_64-${{ github.sha }}
           path: runtime-distribution-certification/macos-x86_64
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: certification-runtime-distribution-macos-arm64-${{ github.sha }}
           path: runtime-distribution-certification/macos-arm64
diff --git a/.github/workflows/required-gates.yml b/.github/workflows/required-gates.yml
index 66277b5..d71eb39 100644
--- a/.github/workflows/required-gates.yml
+++ b/.github/workflows/required-gates.yml
@@ -18,8 +18,8 @@ jobs:
     name: Required CI
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: rustfmt
       - name: Validate locked Rust graph
@@ -34,7 +34,7 @@ jobs:
       run:
         working-directory: packages/octane
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
@@ -54,7 +54,7 @@ jobs:
       run:
         working-directory: packages/http
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.4'
@@ -77,7 +77,7 @@ jobs:
     name: Required Composer packages
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: shivammathur/setup-php@v2
@@ -97,8 +97,8 @@ jobs:
     name: Required security
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'
diff --git a/.github/workflows/runtime-distribution.yml b/.github/workflows/runtime-distribution.yml
index 0d22fc0..ca1f5a1 100644
--- a/.github/workflows/runtime-distribution.yml
+++ b/.github/workflows/runtime-distribution.yml
@@ -39,12 +39,12 @@ jobs:
       contents: read
       attestations: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.current_ref }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: pam-${{ matrix.target }}
           path: candidate
@@ -328,7 +328,7 @@ jobs:
           test "${PAM_EXPECTED_EVIDENCE_IDENTITY}" = \
             "$(jq -r '.signingIdentitySha256' certification/verification.json)"
           rm certification/draft.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: certification-runtime-distribution-${{ matrix.target }}-${{ github.sha }}
           path: certification/
@@ -354,12 +354,12 @@ jobs:
       contents: read
       attestations: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.current_ref }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: pam-${{ matrix.target }}
           path: candidate
@@ -602,7 +602,7 @@ jobs:
           test "${PAM_EXPECTED_EVIDENCE_IDENTITY}" = \
             "$(jq -r '.signingIdentitySha256' certification/verification.json)"
           rm certification/draft.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: certification-runtime-distribution-${{ matrix.target }}-${{ github.sha }}
           path: certification/
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ed973cd..3c665a8 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v5
-      - uses: dtolnay/rust-toolchain@1.88.0
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: shivammathur/setup-php@v2
         with:
           php-version: '8.5'