diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9fb0f96..9869de1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
     name: Rust engine — fmt · clippy · test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # midir (MIDI input) links ALSA on Linux — its -sys crate needs the dev
       # headers to build. macOS/Windows use CoreMIDI/WinMM (no extra packages).
@@ -31,7 +31,7 @@ jobs:
       # is reproducible (a newer rustfmt/clippy can reformat or add lints and
       # turn `--check` / `-D warnings` red on unrelated changes).
       - name: Install Rust 1.95.0
-        uses: dtolnay/rust-toolchain@1.95.0
+        uses: dtolnay/rust-toolchain@1.120.0
         with:
           components: rustfmt, clippy
 
@@ -50,7 +50,7 @@ jobs:
     name: Flutter — analyze
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Pinned to the local version: pubspec requires Dart ^3.12, and the UI
       # uses Dart 3.12 features (e.g. `(_, _)` wildcard params).
@@ -92,14 +92,14 @@ jobs:
     name: macOS — native build smoke test
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # cargokit invokes cargo during `flutter build`, so the same pinned Rust
       # as the `rust` job must be present. No `rustup target add` needed: a
       # host-arch debug build is enough to catch link/framework breakage (the
       # release job handles the universal arm64+x86_64 build).
       - name: Install Rust 1.95.0
-        uses: dtolnay/rust-toolchain@1.95.0
+        uses: dtolnay/rust-toolchain@1.120.0
 
       - uses: Swatinem/rust-cache@v2
 
@@ -130,7 +130,7 @@ jobs:
     name: Linux — native build smoke test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Linux build deps
         run: |
@@ -142,7 +142,7 @@ jobs:
       # cargokit invokes cargo during `flutter build`, so the same pinned Rust
       # as the `rust` job must be present.
       - name: Install Rust 1.95.0
-        uses: dtolnay/rust-toolchain@1.95.0
+        uses: dtolnay/rust-toolchain@1.120.0
 
       - uses: Swatinem/rust-cache@v2
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2d7b9fd..260d386 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
             platform: linux
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Flutter Linux desktop needs GTK + the CMake/Ninja toolchain; patch-core
       # links ALSA (midir) and audioplayers_linux links GStreamer. macOS/Windows
@@ -63,7 +63,7 @@ jobs:
       # so the Rust toolchain must be present. macOS links CoreMIDI, Windows
       # WinMM — neither needs an extra system package (ALSA is Linux-only).
       - name: Install Rust 1.95.0
-        uses: dtolnay/rust-toolchain@1.95.0
+        uses: dtolnay/rust-toolchain@1.120.0
 
       - uses: Swatinem/rust-cache@v2
 
@@ -183,7 +183,7 @@ jobs:
             "$GITHUB_WORKSPACE/Patch-${{ steps.version.outputs.version }}-linux-x86_64.AppImage"
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: patch-${{ matrix.platform }}
           path: |
@@ -199,13 +199,13 @@ jobs:
     permissions:
       contents: write # create the release + upload assets
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
 
       - name: Create draft release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             artifacts/*.dmg