diff --git a/.github/workflows/aur-check.yml b/.github/workflows/aur-check.yml
index 2f70d028..cbec4998 100644
--- a/.github/workflows/aur-check.yml
+++ b/.github/workflows/aur-check.yml
@@ -23,7 +23,7 @@ jobs:
         run: pacman -Syu --noconfirm git sudo namcap
 
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up build user
         run: |
diff --git a/.github/workflows/boundary-artifact-release.yml b/.github/workflows/boundary-artifact-release.yml
index 284beca2..4d4e8d3c 100644
--- a/.github/workflows/boundary-artifact-release.yml
+++ b/.github/workflows/boundary-artifact-release.yml
@@ -21,10 +21,10 @@ jobs:
     outputs:
       tag: ${{ steps.prepare.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.source_commit }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -43,7 +43,7 @@ jobs:
           ARTIFACT: ${{ inputs.artifact }}
           APPROVED_SOURCE: ${{ inputs.source_commit }}
         run: node tooling/scripts/prepare-boundary-release.mjs "$ARTIFACT"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: boundary-release
           path: ${{ steps.prepare.outputs.directory }}
@@ -55,7 +55,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: boundary-release
           path: release
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ea32f3b..76ebdd30 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -44,10 +44,10 @@ jobs:
           - windows-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -86,7 +86,7 @@ jobs:
 
       - name: Retain browser evidence
         if: always() && matrix.os == 'ubuntu-latest'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: app-core-browser-evidence
           path: ${{ runner.temp }}/app-core-browser-evidence
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d5746380..17468999 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 2067d579..4d39bd32 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -26,7 +26,7 @@ jobs:
         download-attempts = 5
         connect-timeout = 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
diff --git a/.github/workflows/nix-update.yml b/.github/workflows/nix-update.yml
index 4745f6c3..de59abdf 100644
--- a/.github/workflows/nix-update.yml
+++ b/.github/workflows/nix-update.yml
@@ -30,7 +30,7 @@ jobs:
         download-attempts = 5
         connect-timeout = 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -69,7 +69,7 @@ jobs:
         run: nix build --fallback .#zennotes-desktop --no-link --print-build-logs
 
       - name: Open a PR with the update
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v8
         with:
           branch: nix/update-v${{ inputs.version }}
           add-paths: packaging/nix/release-data.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f5349e77..f4b07218 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -107,12 +107,12 @@ jobs:
       REQUIRE_MAC_SIGNING: "true"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -194,7 +194,7 @@ jobs:
         # endpoint has a bad day, and a platform build takes up to 40 minutes.
         # With the build kept here, a failed upload is finished by hand from
         # this artifact instead of being built again.
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-${{ matrix.name }}
           path: release-assets/
diff --git a/.github/workflows/share-viewer-artifact.yml b/.github/workflows/share-viewer-artifact.yml
index d46b0bc9..1b685d36 100644
--- a/.github/workflows/share-viewer-artifact.yml
+++ b/.github/workflows/share-viewer-artifact.yml
@@ -19,15 +19,15 @@ jobs:
   candidate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: node --test tooling/scripts/pack-web-artifact.test.mjs
       - run: npm run pack:share-viewer
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: share-viewer-candidate
           path: dist/viewer-artifacts/*
diff --git a/.github/workflows/verify-release-channels.yml b/.github/workflows/verify-release-channels.yml
index 2e0bf04a..8d3cce51 100644
--- a/.github/workflows/verify-release-channels.yml
+++ b/.github/workflows/verify-release-channels.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
diff --git a/.github/workflows/web-artifact.yml b/.github/workflows/web-artifact.yml
index 410a76d1..41bb7675 100644
--- a/.github/workflows/web-artifact.yml
+++ b/.github/workflows/web-artifact.yml
@@ -19,15 +19,15 @@ jobs:
   browser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run test:web-artifact
       - run: npm run artifact:web
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: self-hosted-web-candidate
           path: dist/web-artifacts/*