diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 318d4af969..b74eec90ae 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -36,4 +36,4 @@ jobs:
                   github-token: ${{ secrets.GITHUB_TOKEN }}
             - name: Deploy to GitHub Pages
               id: deployment
-              uses: actions/deploy-pages@v4
+              uses: actions/deploy-pages@v5
diff --git a/.github/workflows/squad-heartbeat.yml b/.github/workflows/squad-heartbeat.yml
index 89857049f4..b7ed47de96 100644
--- a/.github/workflows/squad-heartbeat.yml
+++ b/.github/workflows/squad-heartbeat.yml
@@ -25,7 +25,7 @@ jobs:
     heartbeat:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Check triage script
               id: check-script
@@ -48,7 +48,7 @@ jobs:
 
             - name: Ralph — Apply triage decisions
               if: steps.check-script.outputs.has_script == 'true' && hashFiles('triage-results.json') != ''
-              uses: actions/github-script@v7
+              uses: actions/github-script@v9
               with:
                   script: |
                       const fs = require('fs');
@@ -100,7 +100,7 @@ jobs:
             # Copilot auto-assign step (uses PAT if available)
             - name: Ralph — Assign @copilot issues
               if: success()
-              uses: actions/github-script@v7
+              uses: actions/github-script@v9
               with:
                   github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }}
                   script: |
diff --git a/.github/workflows/squad-issue-assign.yml b/.github/workflows/squad-issue-assign.yml
index 20dd287676..b55077185e 100644
--- a/.github/workflows/squad-issue-assign.yml
+++ b/.github/workflows/squad-issue-assign.yml
@@ -14,10 +14,10 @@ jobs:
         if: startsWith(github.event.label.name, 'squad:')
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Identify assigned member and trigger work
-              uses: actions/github-script@v7
+              uses: actions/github-script@v9
               with:
                   script: |
                       const fs = require('fs');
@@ -116,7 +116,7 @@ jobs:
             # Separate step: assign @copilot using PAT (required for coding agent)
             - name: Assign @copilot coding agent
               if: github.event.label.name == 'squad:copilot'
-              uses: actions/github-script@v7
+              uses: actions/github-script@v9
               with:
                   github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN }}
                   script: |
diff --git a/.github/workflows/squad-triage.yml b/.github/workflows/squad-triage.yml
index 6f962a1257..2ed5c3273b 100644
--- a/.github/workflows/squad-triage.yml
+++ b/.github/workflows/squad-triage.yml
@@ -13,10 +13,10 @@ jobs:
         if: github.event.label.name == 'squad'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Triage issue via Lead agent
-              uses: actions/github-script@v7
+              uses: actions/github-script@v9
               with:
                   script: |
                       const fs = require('fs');
diff --git a/.github/workflows/sync-squad-labels.yml b/.github/workflows/sync-squad-labels.yml
index 26fd24f152..f867d7c5c7 100644
--- a/.github/workflows/sync-squad-labels.yml
+++ b/.github/workflows/sync-squad-labels.yml
@@ -15,10 +15,10 @@ jobs:
     sync-labels:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
 
             - name: Parse roster and sync labels
-              uses: actions/github-script@v7
+              uses: actions/github-script@v9
               with:
                   script: |
                       const fs = require('fs');