diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a8c0427..4e52fd2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,9 +15,9 @@ jobs:
     name: Validate manifests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
 
@@ -29,11 +29,11 @@ jobs:
     name: Format & Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
@@ -48,7 +48,7 @@ jobs:
     name: Shellcheck skill scripts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # shellcheck is preinstalled on the GitHub-hosted ubuntu runner. The skill's
       # audit/baseline/measure scripts run in users' repos, so a shell bug ships to
@@ -60,11 +60,11 @@ jobs:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index 14a1a81..fb7e4a6 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -21,10 +21,10 @@ jobs:
       contents: read
       issues: write # for the optional issue-creation step on scheduled runs
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Restore lychee cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .lycheecache
           key: lychee-${{ github.sha }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Create issue on broken links (scheduled runs only)
         if: github.event_name == 'schedule' && env.lychee_exit_code != '0'
-        uses: peter-evans/create-issue-from-file@v5
+        uses: peter-evans/create-issue-from-file@v6
         with:
           title: "Broken links detected by lychee"
           content-filepath: ./lychee/out.md
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2dd821a..12fc967 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,6 @@ jobs:
       # `repo` scope, or fine-grained with Contents + Pull requests: write) as the
       # RELEASE_PLEASE_TOKEN repo secret. The expression falls back to GITHUB_TOKEN so
       # the workflow still parses if the secret is absent (it just won't open the PR).
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}