diff --git a/.github/workflows/production-smoke.yml b/.github/workflows/production-smoke.yml
index 201ecf0..cc94aac 100644
--- a/.github/workflows/production-smoke.yml
+++ b/.github/workflows/production-smoke.yml
@@ -42,10 +42,10 @@ jobs:
     env:
       SMOKE_BASE_URL: ${{ inputs.base_url || 'https://www.seasaba.com' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -57,7 +57,7 @@ jobs:
           echo "smoke target: $SMOKE_BASE_URL"
       - run: npm ci
       - run: npm run test:smoke:prod
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: production-smoke-results
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c668007..caea9ea 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,10 +24,10 @@ jobs:
       options: --user 1001
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -38,7 +38,7 @@ jobs:
       - run: npm run test:coverage
       - run: npm run build:test
       - run: npm run test:e2e
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: website-test-results
@@ -57,10 +57,10 @@ jobs:
       options: --user 1001
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -69,7 +69,7 @@ jobs:
       # Lab budgets vs the test build: analytics IDs empty + vendors blocked
       # inside the run, so no third-party uptime can flake the gate.
       - run: node scripts/perf-baseline.mjs
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: performance-report