diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8519bb4..c1b6f17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
     name: "🔒 Lint, Test & Security"
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       # ── Stage 1/6: Banner + tooling ──
       # Prints the Code To Cloud banner and installs ShellCheck,
@@ -176,7 +176,7 @@ jobs:
       # ── Artifact upload (always, even on failure) ──
       - name: Upload all test results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: lint-test-security-results
           path: test-results/
@@ -188,7 +188,7 @@ jobs:
       # developers see failures inline without opening logs.
       - name: Test report — Unit
         if: always()
-        uses: dorny/test-reporter@v2
+        uses: dorny/test-reporter@v3
         with:
           name: Unit Tests
           path: test-results/unit.xml
@@ -197,7 +197,7 @@ jobs:
 
       - name: Test report — Integration
         if: always()
-        uses: dorny/test-reporter@v2
+        uses: dorny/test-reporter@v3
         with:
           name: Integration Tests
           path: test-results/integration.xml
@@ -206,7 +206,7 @@ jobs:
 
       - name: Test report — Security
         if: always()
-        uses: dorny/test-reporter@v2
+        uses: dorny/test-reporter@v3
         with:
           name: Security Tests
           path: test-results/security.xml
@@ -258,7 +258,7 @@ jobs:
       image: ubuntu:${{ matrix.ubuntu }}
       options: --user root
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       # ── Stage 1/4: Provision container ──
       # Minimal apt install — only what's needed for container tests.
@@ -353,7 +353,7 @@ jobs:
 
       - name: Upload container results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: container-results-${{ matrix.ubuntu }}
           path: test-results/
@@ -390,7 +390,7 @@ jobs:
       image: ubuntu:24.04
       options: --user root
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       # ── Stage 1/5: Provision multi-user container ──
       # Creates user1 and user2 to simulate a shared workstation
@@ -497,7 +497,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: system-docs-results
           path: test-results/
@@ -527,7 +527,7 @@ jobs:
     runs-on: ubuntu-24.04
     needs: lint-test-security
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       # ── Stage 1/3: Build image ──
       # Uses docker/build-push-action with GHA cache for speed.
@@ -542,10 +542,10 @@ jobs:
           echo "└──────────────────────────────────────────────┘"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: false
@@ -586,7 +586,7 @@ jobs:
       # ── Stage 3/3: Upload metadata ──
       - name: "📊 Stage 3/3 — Upload results"
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: docker-build-results
           path: test-results/
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index e0a1cbd..3f7dca4 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -33,7 +33,7 @@ jobs:
           - ubuntu: "24.04"
             codename: "noble"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Create test container
         run: |
@@ -203,7 +203,7 @@ jobs:
 
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-install-logs-ubuntu-${{ matrix.ubuntu }}
           path: |
@@ -268,7 +268,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Run minimal install
         run: |
@@ -314,7 +314,7 @@ jobs:
 
       - name: Upload minimal install logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-minimal-install-logs
           path: test-output/minimal-install-log.txt
@@ -343,7 +343,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Run system-wide install with multiple users
         run: |
@@ -403,7 +403,7 @@ jobs:
 
       - name: Upload system-wide logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-system-wide-logs
           path: test-output/system-wide-log.txt
diff --git a/.github/workflows/website-tests.yml b/.github/workflows/website-tests.yml
index 01724f6..8dc1e20 100644
--- a/.github/workflows/website-tests.yml
+++ b/.github/workflows/website-tests.yml
@@ -18,20 +18,20 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '22'
       - run: npm ci
       - run: npx playwright install --with-deps
       - run: npx playwright test
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report
           path: playwright-report/
           retention-days: 7
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: test-results