diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3b1ca60
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+# Keeps the GitHub Actions pins in .github/workflows/ on current majors.
+# Two groups, as QuantEcon/actions does, so updates land as at most two PRs a
+# week: minor and patch updates together, and major updates on their own.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "⬆️"
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: [minor, patch]
+      github-actions-major:
+        patterns: ["*"]
+        update-types: [major]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ae103b..e687a3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout current branch
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         ref: ${{ github.head_ref }}
         token: ${{ env.GH_TOKEN }}
@@ -45,9 +45,9 @@ jobs:
         echo "PR number: ${{ github.event.number }}"
         echo "Commit SHA: ${{ github.sha }}"
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v7
       with:
-        node-version: 20.x
+        node-version: '24'
 
     - name: Install MyST Markdown CLI
       run: |
@@ -71,7 +71,7 @@ jobs:
         myst build --html
 
     - name: Upload build output
-      uses: actions/upload-pages-artifact@v3
+      uses: actions/upload-pages-artifact@v5
       with:
         path: './lectures/_build/html'
 
@@ -79,7 +79,7 @@ jobs:
     - name: Deploy to GitHub Pages
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       id: deployment
-      uses: actions/deploy-pages@v4
+      uses: actions/deploy-pages@v5
 
     - name: Install Netlify CLI
       if: github.event_name == 'pull_request'
@@ -124,7 +124,7 @@ jobs:
 
     - name: Post PR Comment with Preview Link
       if: github.event_name == 'pull_request'
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: |
           const deployUrl = `${{ steps.netlify-deploy.outputs.deploy_url }}`;
diff --git a/.github/workflows/data-url-guard.yml b/.github/workflows/data-url-guard.yml
index 245a100..8b10559 100644
--- a/.github/workflows/data-url-guard.yml
+++ b/.github/workflows/data-url-guard.yml
@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: No data-lectures read on the LFS media host
         run: |
           # media.githubusercontent.com is the LFS *media* endpoint and routes