diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d90045..6524d0a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-playwright
         with:
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-playwright
         with:
@@ -108,7 +108,7 @@ jobs:
       - name: Run API tests
         run: pytest -m "api and not ui" --no-app -v
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: report-api
@@ -151,7 +151,7 @@ jobs:
             shard: 4
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-playwright
         with:
@@ -185,7 +185,7 @@ jobs:
       # the trace off the runner, and the trace is how you debug without
       # reproducing locally.
       - name: Upload report, traces, videos
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: report-${{ matrix.browser }}-py${{ matrix.python }}-shard${{ matrix.shard }}
@@ -204,7 +204,7 @@ jobs:
     timeout-minutes: 15
     continue-on-error: true      # <-- the whole point of this job
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-playwright
         with:
           browser: chromium
@@ -227,10 +227,10 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Download every shard's artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: report-*
           path: all-reports
@@ -259,7 +259,7 @@ jobs:
           ls -R site | head -50
 
       - name: Upload combined site
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: combined-report
           path: site/
@@ -274,7 +274,7 @@ jobs:
       - name: Comment result on the pull request
         if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
         continue-on-error: true
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const ui = '${{ needs.ui-tests.result }}';
diff --git a/.github/workflows/manual-run.yml b/.github/workflows/manual-run.yml
index 62f0b98..0fba6f9 100644
--- a/.github/workflows/manual-run.yml
+++ b/.github/workflows/manual-run.yml
@@ -61,7 +61,7 @@ jobs:
       TEST_USER: ${{ vars.TEST_USER || 'demo' }}
       TEST_PASSWORD: ${{ secrets.TEST_PASSWORD || 'Password123' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-playwright
         with:
@@ -113,7 +113,7 @@ jobs:
             echo "| Workers | ${{ inputs.workers }} |"
           } >> "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: manual-run-${{ github.run_number }}
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index cb8d9c0..bf97472 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -39,7 +39,7 @@ jobs:
       matrix:
         browser: [chromium, firefox, webkit]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: ./.github/actions/setup-playwright
         with:
@@ -67,7 +67,7 @@ jobs:
             --html=reports/report.html --self-contained-html \
             -v
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: nightly-${{ matrix.browser }}
@@ -82,7 +82,7 @@ jobs:
     # THIS runner image, flip this to false and the job becomes a real gate.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-playwright
         with:
           browser: chromium
@@ -93,7 +93,7 @@ jobs:
       # generated. Download it, eyeball every PNG, commit them to
       # tests/**/__snapshots__/, then set continue-on-error: false.
       - name: Upload generated baselines / diffs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: visual-baselines-and-diffs
@@ -109,7 +109,7 @@ jobs:
     timeout-minutes: 20
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: ./.github/actions/setup-playwright
         with:
           browser: chromium
@@ -125,7 +125,7 @@ jobs:
       issues: write
     steps:
       - name: Open or update a tracking issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const title = `Nightly regression failed - ${new Date().toISOString().slice(0,10)}`;
diff --git a/.github/workflows/publish-report.yml b/.github/workflows/publish-report.yml
index a57b187..38251a7 100644
--- a/.github/workflows/publish-report.yml
+++ b/.github/workflows/publish-report.yml
@@ -42,10 +42,10 @@ jobs:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Download the combined report from the CI run
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         continue-on-error: true
         with:
           name: combined-report
@@ -64,11 +64,11 @@ jobs:
       # fresh fork does not need anyone to click through Settings first.
       # Without it this job dies with:
       #   HttpError: Not Found - Get Pages site failed
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@v6
         with:
           enablement: true
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
       - id: deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5