diff --git a/.github/workflows/check-pinned-versions.yml b/.github/workflows/check-pinned-versions.yml
index 82fbda0..fb8f38f 100644
--- a/.github/workflows/check-pinned-versions.yml
+++ b/.github/workflows/check-pinned-versions.yml
@@ -13,7 +13,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Check for unpinned dependency versions
         run: |
diff --git a/.github/workflows/e2e-coverage-bot.yml b/.github/workflows/e2e-coverage-bot.yml
index 14d1497..66cf6a1 100644
--- a/.github/workflows/e2e-coverage-bot.yml
+++ b/.github/workflows/e2e-coverage-bot.yml
@@ -47,7 +47,7 @@ jobs:
     steps:
       # Checkout the PR branch using the bot token so git push works
       # and so `gh` CLI inside Claude is authenticated as the bot account
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
@@ -56,7 +56,7 @@ jobs:
       - name: Fetch base branch
         run: git fetch origin ${{ github.base_ref }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
 
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index f2363ec..6ebbda3 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set validation status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const labels = context.payload.pull_request.labels.map(l => l.name);
@@ -70,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Update validation status from E2E result
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const run = context.payload.workflow_run;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 881c14d..91d80f9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,18 +18,18 @@ jobs:
     if: "!startsWith(github.event.head_commit.message, 'chore(skills): release') && !startsWith(github.event.head_commit.message, 'chore(tauri):')"
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GIT_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '25.3.0'
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/reusable-oci-test-runner.yml b/.github/workflows/reusable-oci-test-runner.yml
index a357c17..60c6aa8 100644
--- a/.github/workflows/reusable-oci-test-runner.yml
+++ b/.github/workflows/reusable-oci-test-runner.yml
@@ -122,7 +122,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout ops
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: iblai/ibl-web-ops
           token: ${{ secrets.GIT_TOKEN || github.token }}
@@ -184,7 +184,7 @@ jobs:
           echo "Workspace cleaned: ${{ github.workspace }}"
 
       - name: Checkout ops
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: iblai/ibl-web-ops
           token: ${{ secrets.GIT_TOKEN || github.token }}
diff --git a/.github/workflows/reusable-pr-docker-build.yml b/.github/workflows/reusable-pr-docker-build.yml
index e3132bc..ea28eaa 100644
--- a/.github/workflows/reusable-pr-docker-build.yml
+++ b/.github/workflows/reusable-pr-docker-build.yml
@@ -65,17 +65,17 @@ jobs:
       image-tag: ${{ steps.set-outputs.outputs.image-tag }}
     steps:
       - name: Checkout source repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout ops actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: iblai/ibl-web-ops
           token: ${{ secrets.GIT_TOKEN || github.token }}
           path: .ops
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Generate or use image tag
         id: tag
@@ -96,7 +96,7 @@ jobs:
       # ECR Login and Build
       - name: Configure AWS Credentials
         if: inputs.registry-type == 'ecr'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -120,7 +120,7 @@ jobs:
       # OCIR Login and Build
       - name: Log in to OCIR
         if: inputs.registry-type == 'ocir'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.OCIR_REGISTRY }}
           username: ${{ env.OCIR_NAMESPACE }}/${{ secrets.OCIR_USERNAME }}
diff --git a/.github/workflows/reusable-release-macos-dmg.yml b/.github/workflows/reusable-release-macos-dmg.yml
index aa7ec5d..2dcbb82 100644
--- a/.github/workflows/reusable-release-macos-dmg.yml
+++ b/.github/workflows/reusable-release-macos-dmg.yml
@@ -88,18 +88,18 @@ jobs:
       APPLE_SIGNING_IDENTITY: ${{ inputs.apple_signing_identity }}
       APPLE_TEAM_ID: ${{ inputs.apple_team_id }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Node/pnpm are only needed so tauri-action can resolve the project's
       # package manager; the frontend bundle is prebuilt/remote (frontendDist),
       # so there's no `next build` here.
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ inputs.node_version }}
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -119,7 +119,7 @@ jobs:
       # existing v<version> Release rather than a parallel one.
       - name: Build, sign & notarize DMG
         id: tauri
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Enable in-app purchase for release builds when requested. Read at Rust
@@ -137,7 +137,7 @@ jobs:
 
       # Always keep the DMG as a CI artifact (SHA-named for dev builds).
       - name: Upload DMG artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ inputs.artifact_name }}
           path: ${{ inputs.dmg_path }}
diff --git a/.github/workflows/reusable-spa-docker-build.yml b/.github/workflows/reusable-spa-docker-build.yml
index 0e0499d..75df8e6 100644
--- a/.github/workflows/reusable-spa-docker-build.yml
+++ b/.github/workflows/reusable-spa-docker-build.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: oci-runner-1
     steps:
       - name: Clone source repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ${{ inputs.source_repo }}
           ref: ${{ inputs.source_ref }}
@@ -48,7 +48,7 @@ jobs:
           fetch-depth: 1
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
diff --git a/.github/workflows/tauri-autoversion.yml b/.github/workflows/tauri-autoversion.yml
index fd09d32..692aa6a 100644
--- a/.github/workflows/tauri-autoversion.yml
+++ b/.github/workflows/tauri-autoversion.yml
@@ -24,13 +24,13 @@ jobs:
     if: "!startsWith(github.event.head_commit.message, 'chore(tauri):')"
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GIT_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '25.3.0'
 
diff --git a/.github/workflows/trigger-docker-build.yml b/.github/workflows/trigger-docker-build.yml
index ddf516d..4d4e7ab 100644
--- a/.github/workflows/trigger-docker-build.yml
+++ b/.github/workflows/trigger-docker-build.yml
@@ -18,7 +18,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Extract version from package.json
         id: version