diff --git a/.github/workflows/chaos-regression.yml b/.github/workflows/chaos-regression.yml
index 019d3d1..e996e03 100644
--- a/.github/workflows/chaos-regression.yml
+++ b/.github/workflows/chaos-regression.yml
@@ -40,6 +40,6 @@ jobs:
        github.event.pull_request.head.repo.full_name == github.repository)
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reboot/chaos self-heal regression probe
         run: bash scripts/ops/chaos_probe.sh
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d7e4f9..a2325ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev deps
@@ -48,7 +48,7 @@ jobs:
   public-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — no dependency on a pre-provisioned runner)
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
@@ -98,7 +98,7 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run forbidden-pattern audit
         run: python3 scripts/checks/audit_forbidden.py --fail --json audit-report.json
       - if: always()
@@ -111,7 +111,7 @@ jobs:
   schema-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Validate all service descriptors
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -150,7 +150,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -166,7 +166,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -181,7 +181,7 @@ jobs:
   constraints-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate dependency constraint planes
         run: python3 scripts/checks/constraints_check.py
 
@@ -189,7 +189,7 @@ jobs:
   docs-mirror-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Validate README language mirrors
         run: python3 scripts/checks/docs_mirror_check.py
 
@@ -198,7 +198,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -214,7 +214,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -234,7 +234,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [schema-validate, deploy-target-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -250,7 +250,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [deploy-target-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -266,7 +266,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [docs-mirror-validate, component-validate, deploy-target-validate, tool-candidate-validate, constraints-validate, topology-validate, healthcheck-tool-validate, kubernetes-render-validate, kubernetes-proof-workflow-validate]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -283,7 +283,7 @@ jobs:
     needs: [audit, schema-validate, component-validate, deploy-target-validate, tool-candidate-validate, constraints-validate, topology-validate, healthcheck-tool-validate, kubernetes-render-validate]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev
@@ -315,7 +315,7 @@ jobs:
     needs: [audit, constraints-validate]
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build base image
         run: docker build -f docker/Dockerfile.base -t agmind-base:ci .
 
@@ -328,7 +328,7 @@ jobs:
       matrix:
         backend: [cpu, vulkan, rocm]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build base + ${{ matrix.backend }} image (self-contained — GitHub-hosted runners do not share local images)
         run: |
@@ -345,7 +345,7 @@ jobs:
     needs: [schema-validate, component-validate, deploy-target-validate, tool-candidate-validate, constraints-validate]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind
@@ -404,7 +404,7 @@ jobs:
     needs: [docker-build, compose-validate]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install agmind + dev
         run: |
           "$HOME/.local/bin/uv" --version
@@ -458,7 +458,7 @@ jobs:
     needs: [schema-validate]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev
@@ -500,7 +500,7 @@ jobs:
       matrix:
         backend: [vulkan, rocm]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Build base + ${{ matrix.backend }} image (self-contained on this runner)
         run: |
           docker build -f docker/Dockerfile.base -t agmind-base:ci .
diff --git a/.github/workflows/kubernetes-proof.yml b/.github/workflows/kubernetes-proof.yml
index b5e9021..cfc197a 100644
--- a/.github/workflows/kubernetes-proof.yml
+++ b/.github/workflows/kubernetes-proof.yml
@@ -36,7 +36,7 @@ jobs:
        github.event.pull_request.head.repo.full_name == github.repository)
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install agmind + dev deps
         run: |
diff --git a/.github/workflows/perf-nightly.yml b/.github/workflows/perf-nightly.yml
index 1dbca5d..56e5d4c 100644
--- a/.github/workflows/perf-nightly.yml
+++ b/.github/workflows/perf-nightly.yml
@@ -39,7 +39,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, strix-halo]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — no dependency on a pre-provisioned runner)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
       - name: Install agmind + dev deps
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 431f9a1..7ac864d 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -48,7 +48,7 @@ jobs:
       checks: read       # read check-runs for the target SHA
       actions: read      # read workflow runs (for check-run context)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           # Do NOT set `ref:` to the input SHA. actions/checkout@v6 resolves `ref` as a
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index c549607..f025c48 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -28,6 +28,6 @@ jobs:
       # SHA-pinned (review LOW ci-actions-mutable-tag-pins): this job runs on
       # pull_request_target with contents+pull-requests write — a force-moved tag would inject
       # code into a token-bearing job. Dependabot (github-actions) bumps the pin via the # v7.
-      - uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449 # v7
+      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 787539f..6e5d24e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,7 +49,7 @@ jobs:
       version: ${{ steps.v.outputs.version }}
       tag: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install package (version check only)
         run: |
           python -m pip install --quiet --no-deps -e .
@@ -130,16 +130,16 @@ jobs:
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: build
         name: Build (and push if PUBLISH)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile.base
@@ -154,7 +154,7 @@ jobs:
 
       - name: Generate SPDX SBOM for base
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v0.22.0.
-        uses: anchore/sbom-action@62ad5284b8ced813296287a0b63906cb364b73ee # v0.22.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ env.IMAGE_NS }}-base@${{ steps.build.outputs.digest }}
           format: spdx-json
@@ -168,7 +168,7 @@ jobs:
         # transitive critical CVE. Tightening to fail-build later is a deliberate follow-up, not a
         # silent default.
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v7.4.0.
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         with:
           sbom: sbom-base.spdx.json
           fail-build: false
@@ -177,7 +177,7 @@ jobs:
 
       - name: Attest base image provenance (SLSA)
         if: vars.PUBLISH == 'true'
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.IMAGE_NS }}-base
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -211,16 +211,16 @@ jobs:
       matrix:
         backend: [cpu, vulkan, rocm]
     steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: build
         name: Build ${{ matrix.backend }} (and push if PUBLISH)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile.${{ matrix.backend }}
@@ -236,7 +236,7 @@ jobs:
 
       - name: Generate SPDX SBOM for ${{ matrix.backend }}
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v0.22.0.
-        uses: anchore/sbom-action@62ad5284b8ced813296287a0b63906cb364b73ee # v0.22.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ env.IMAGE_NS }}-${{ matrix.backend }}@${{ steps.build.outputs.digest }}
           format: spdx-json
@@ -250,7 +250,7 @@ jobs:
         # transitive critical CVE. Tightening to fail-build later is a deliberate follow-up, not a
         # silent default.
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v7.4.0.
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         with:
           sbom: sbom-${{ matrix.backend }}.spdx.json
           fail-build: false
@@ -259,7 +259,7 @@ jobs:
 
       - name: Attest ${{ matrix.backend }} image provenance (SLSA)
         if: vars.PUBLISH == 'true'
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.IMAGE_NS }}-${{ matrix.backend }}
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -289,8 +289,8 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Build wheel + sdist
@@ -306,7 +306,7 @@ jobs:
             -p . agmind/__main__.py
           mv dist/agmind dist/agmind-linux-amd64
       - name: Attest wheel + binary provenance (SLSA)
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: |
             dist/*.whl
@@ -329,14 +329,14 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install agmind
         run: pip install -e .
       - name: Download backend digest + SBOM artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: backend-*
           path: backends
@@ -366,7 +366,7 @@ jobs:
           sha256sum * > checksums-${VER}.txt
 
       - name: Attest catalog provenance (SLSA)
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: release/catalog-${{ needs.meta.outputs.version }}.json
 
@@ -387,12 +387,12 @@ jobs:
       contents: write    # create the GitHub Release
     steps:
       - name: Download all release artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: all
       - name: Publish GitHub Release
         # SHA-pinned (review LOW ci-actions-mutable-tag-pins); Dependabot bumps via the # v2.
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ needs.meta.outputs.tag }}
           generate_release_notes: true
diff --git a/.github/workflows/rendered-diff.yml b/.github/workflows/rendered-diff.yml
index 1f4f6d3..6cd28dd 100644
--- a/.github/workflows/rendered-diff.yml
+++ b/.github/workflows/rendered-diff.yml
@@ -26,12 +26,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout head tree
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: head
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Checkout base tree
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: base
           ref: ${{ github.event.pull_request.base.sha }}
@@ -68,7 +68,7 @@ jobs:
           cat "$GITHUB_WORKSPACE/rendered-diff.md"
       - name: Post/update sticky PR comment
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           REPORT_PATH: ${{ github.workspace }}/rendered-diff.md
         with:
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 934aa09..3293f35 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install uv (fresh — ubuntu-latest has no pre-provisioned uv)
         run: curl -LsSf https://astral.sh/uv/install.sh | sh