diff --git a/.github/workflows/ci-containers-ghcr.yml b/.github/workflows/ci-containers-ghcr.yml
index 450d4d38ed69..cf9609af9299 100644
--- a/.github/workflows/ci-containers-ghcr.yml
+++ b/.github/workflows/ci-containers-ghcr.yml
@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -31,13 +31,13 @@ jobs:
 
       - name: Extract metadata (tags, labels) for default image
         id: meta_default
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ github.repository }}/ci/default
 
       - name: Build and push default container
         id: push_default
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./docker/ccf_ci
@@ -49,7 +49,7 @@ jobs:
           labels: ${{ steps.meta_default.outputs.labels }}
 
       - name: Attest default container
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}/ci/default
           subject-digest: ${{ steps.push_default.outputs.digest }}
diff --git a/.github/workflows/ci-verification.yml b/.github/workflows/ci-verification.yml
index d1f30e1ebfd9..00d06474fcc5 100644
--- a/.github/workflows/ci-verification.yml
+++ b/.github/workflows/ci-verification.yml
@@ -48,7 +48,7 @@ jobs:
       - run: cd tla && ./tlc.py mc consistency/MCMultiNodeReadsAlt.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-model-checking-consistency
@@ -94,7 +94,7 @@ jobs:
       - run: ./tlc.py sim --num 500 --depth 50 consistency/MultiNodeReads.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-simulation-consistency
@@ -128,7 +128,7 @@ jobs:
       - run: cd tla && ./tlc.py --trace-name 1C3N mc --term-count 0 --request-count 3 --raft-configs 1C3N consensus/MCccfraft.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-model-checking-consensus
@@ -154,7 +154,7 @@ jobs:
       - run: ./tlc.py sim consensus/SIMccfraft.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-simulation-consensus
@@ -221,7 +221,7 @@ jobs:
         shell: bash
 
       - name: Upload artifacts.
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: tlc-trace-validation-consensus
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27b06039f322..90e0ebf8a6d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,7 +140,7 @@ jobs:
         shell: bash
 
       - name: "Upload logs for virtual"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-azurelinux-virtual
           path: |
@@ -211,7 +211,7 @@ jobs:
         if: success() || failure()
 
       - name: "Upload logs"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-caci-snp
           path: |
@@ -290,7 +290,7 @@ jobs:
         if: success() || failure()
 
       - name: "Upload logs"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-caci-snp-genoa
           path: |
diff --git a/.github/workflows/containers-ghcr.yml b/.github/workflows/containers-ghcr.yml
index 799a07194c4a..e6adb69c40ed 100644
--- a/.github/workflows/containers-ghcr.yml
+++ b/.github/workflows/containers-ghcr.yml
@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -50,14 +50,14 @@ jobs:
 
       - name: Extract metadata (tags, labels) for the image
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ steps.tref.outputs.img_name }}
         if: ${{ steps.tref.outputs.major_release >= '5'}}
 
       - name: Build and push container
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./docker/app_${{ matrix.type }}
@@ -71,7 +71,7 @@ jobs:
         if: ${{ steps.tref.outputs.major_release >= '5'}}
 
       - name: Attest container
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ steps.tref.outputs.img_name }}
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 273157fedb40..7a57ff440e90 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Build Documentation
         run: |
@@ -52,7 +52,7 @@ jobs:
         shell: bash
 
       - name: Upload pages
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v4
         with:
           path: build/html
 
@@ -72,4 +72,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/long-test.yml b/.github/workflows/long-test.yml
index 5b1771221fc6..b6ac4b53c69d 100644
--- a/.github/workflows/long-test.yml
+++ b/.github/workflows/long-test.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: "Upload logs"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-asan
           path: |
@@ -110,7 +110,7 @@ jobs:
 
       - name: "Upload logs"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-tsan
           path: |
@@ -163,7 +163,7 @@ jobs:
 
       - name: "Upload logs"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-lts
           path: |
@@ -222,7 +222,7 @@ jobs:
 
       - name: "Upload logs"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-e2e-debug
           path: |
@@ -276,7 +276,7 @@ jobs:
 
       - name: "Upload logs"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-e2e-release
           path: |
@@ -330,7 +330,7 @@ jobs:
 
       - name: "Upload logs"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-e2e-shuffled
           path: |
diff --git a/.github/workflows/long-verification.yml b/.github/workflows/long-verification.yml
index f353a567cfd1..a826fe355d7b 100644
--- a/.github/workflows/long-verification.yml
+++ b/.github/workflows/long-verification.yml
@@ -42,7 +42,7 @@ jobs:
       - run: cd tla && ./tlc.py --trace-name 2C2N mc --term-count 2 --request-count 0 --raft-configs 2C2N --disable-check-quorum consensus/MCccfraft.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-model-checking-with-atomic-reconfig-consensus
@@ -75,7 +75,7 @@ jobs:
       - run: cd tla && ./tlc.py --trace-name 3C2N mc --term-count 2 --request-count 0 --raft-configs 3C2N --disable-check-quorum consensus/MCccfraft.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-model-checking-with-reconfig-consensus
@@ -101,7 +101,7 @@ jobs:
       - run: ./tlc.py sim --max-seconds 3000 --depth 500 consensus/SIMccfraft.tla
 
       - name: Upload TLC traces
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ failure() }}
         with:
           name: tlc-simulation-consensus
diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
index 8a4c9a63ef18..e5dd9639bace 100644
--- a/.github/workflows/npm.yml
+++ b/.github/workflows/npm.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/release-attestation.yml b/.github/workflows/release-attestation.yml
index 0775fe553839..2c7e82bbaedf 100644
--- a/.github/workflows/release-attestation.yml
+++ b/.github/workflows/release-attestation.yml
@@ -37,7 +37,7 @@ jobs:
 
       - name: Attest release assets
         id: attest
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: "release-assets/*"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index baa072410b75..873c43a166df 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
           ./sbom-tool generate -b . -bc . -pn CCF -ps Microsoft -nsb https://sbom.microsoft -pv $CCF_VERSION -V Error
         shell: bash
       - name: "Upload SBOM"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom
           path: _manifest/spdx_2.2/*
@@ -59,7 +59,7 @@ jobs:
           set -o pipefail
           python ./scripts/extract-release-notes.py --target-git-version --describe-path-changes "./samples/constitution" | tee rel-notes.md
       - name: "Upload Release Notes"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: relnotes
           path: rel-notes.md
@@ -159,7 +159,7 @@ jobs:
 
       - name: "Upload logs for ${{ matrix.platform.name }}"
         if: success() || failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: logs-${{ matrix.platform.name }}
           path: |
@@ -238,27 +238,27 @@ jobs:
         shell: bash
 
       - name: "Upload .rpm Package"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pkg-${{ matrix.platform.name }}
           path: build/${{ steps.make_rpm_run.outputs.name }}
 
       - name: "Upload -devel.rpm Package"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pkg-${{ matrix.platform.name }}-devel
           path: build/${{ steps.make_rpm_devel.outputs.name }}
 
       - name: "Upload Compatibility Report"
         if: "${{ matrix.platform.name == 'virtual' }}"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: compatibility
           path: build/compatibility_report.json
 
       - name: "Upload TLS Report"
         if: "${{ matrix.platform.name == 'virtual' }}"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tls
           path: build/tls_report.html
@@ -279,7 +279,7 @@ jobs:
 
       - name: "Upload Python Wheel"
         if: "${{ matrix.platform.name == 'virtual' }}"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheel
           path: python/${{ steps.build_wheel.outputs.name }}
@@ -301,7 +301,7 @@ jobs:
 
       - name: "Upload TS Package"
         if: "${{ matrix.platform.name == 'virtual' }}"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tstgz
           path: js/ccf-app/${{ steps.build_tstgz.outputs.name }}
@@ -326,7 +326,7 @@ jobs:
           cat $filename
 
       - name: "Upload Reproducibility Metadata"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: reproduce-${{ matrix.platform.name }}-metadata
           path: reproduce-${{ matrix.platform.name }}.json
@@ -361,13 +361,13 @@ jobs:
         with:
           fetch-depth: 0
       - name: Download Prebuilt Packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: DOWNLOAD_DIR
           pattern: pkg-*
           merge-multiple: true
       - name: Download Reproducibility Metadata
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: repro
           pattern: reproduce-${{ matrix.platform.name }}-metadata
@@ -399,7 +399,7 @@ jobs:
           done
       - name: Upload Non-Reproduced Package
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: not-reproduced
           path: ${{ env.REPRO_DIR }}
@@ -416,40 +416,40 @@ jobs:
         with:
           fetch-depth: 1
       - name: Download Packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: pkg
           pattern: pkg-*
           merge-multiple: true
       - name: Download Release Notes
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: relnotes
       - name: Download Compatibility Report
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: compatibility
       - name: Download TLS Report
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: tls
       - name: Download Python Wheel
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: wheel
           name: wheel
       - name: Download TS Package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: tstgz
           name: tstgz
       - name: Download SBOM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: sbom
           name: sbom
       - name: Download Reproducibility Metadata
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: repro
           pattern: reproduce-*