diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6b2638..4b9c037 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run format and clippy
         run: make ci
       - name: Verify PGP Key Generation
@@ -38,7 +38,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Proactive Disk Hygiene
         run: rm -rf /tmp/openhttpa-build-* || true
       - name: Run core tests
@@ -49,7 +49,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check bindings and examples
         run: make check-bindings verify-examples
 
@@ -58,6 +58,6 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run ProVerif/Tamarin Proofs
         run: make formal-verify
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 94879ef..8889068 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -132,7 +132,7 @@ jobs:
       # Pinned SHA: actions/checkout v4.2.2 (2025-01-13)
       # Update via Dependabot or: gh api repos/actions/checkout/git/ref/tags/v4
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
           submodules: recursive
@@ -176,7 +176,7 @@ jobs:
       #
       # Pinned SHA: actions/cache v4.2.3 (2025-03-05)
       - name: Cache Cargo registry and git deps
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 749faae..33534c1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1
       - uses: dtolnay/rust-toolchain@stable
@@ -88,13 +88,13 @@ jobs:
     needs: [validate]
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: pip install maturin
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: target/release-hardened
           key: ${{ runner.os }}-cargo-release-hardened-${{ hashFiles('**/Cargo.lock') }}
@@ -109,9 +109,9 @@ jobs:
     needs: [validate]
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '${{ env.NODE_VERSION }}'
           registry-url: 'https://registry.npmjs.org'
@@ -127,17 +127,17 @@ jobs:
     needs: [validate]
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32-unknown-unknown
       - uses: taiki-e/install-action@v2
         with:
           tool: wasm-pack@${{ env.WASM_PACK_VERSION }}
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: ${{ env.PNPM_VERSION }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
@@ -153,9 +153,9 @@ jobs:
     needs: [validate]
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.22'
       - name: Build and Tag Go FFI package
@@ -169,7 +169,7 @@ jobs:
     needs: [validate]
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - name: Publish workspace crates to crates.io
         env:
@@ -186,9 +186,9 @@ jobs:
     runs-on: self-hosted
     needs: [publish-python, publish-npm, publish-wasm, publish-go, publish-crates]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: target/release-hardened
           key: ${{ runner.os }}-cargo-release-hardened-${{ hashFiles('**/Cargo.lock') }}
@@ -198,10 +198,10 @@ jobs:
           DRY_RUN: true
         run: make publish-github
       - name: Generate build attestation
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: target/release-hardened/backend
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           files: |