diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 726d655..4ac0a07 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 686a224..ff7256b 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -43,7 +43,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/maestro-kpi-aggregate.yml b/.github/workflows/maestro-kpi-aggregate.yml
index 7e245a4..b8e24ed 100644
--- a/.github/workflows/maestro-kpi-aggregate.yml
+++ b/.github/workflows/maestro-kpi-aggregate.yml
@@ -27,7 +27,7 @@ jobs:
       # high blast radius. Other workflows in this repo use tags; bump
       # this one when the actions release a meaningful new version.
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Validate secrets
         run: |
@@ -47,7 +47,7 @@ jobs:
       - name: Download yesterday's pass rates (best-effort)
         id: yesterday
         continue-on-error: true
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           name: kpi-pass-rate-latest
           path: yesterday/
@@ -84,7 +84,7 @@ jobs:
       # detect a 2-consecutive-day breach. 7-day retention is more than
       # enough (we only ever read the most-recent artifact).
       - name: Upload today's pass rates
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: kpi-pass-rate-latest
           path: pass.jsonl
diff --git a/.github/workflows/test-claude-auto-review.yml b/.github/workflows/test-claude-auto-review.yml
index 02cfce8..98ccb2f 100644
--- a/.github/workflows/test-claude-auto-review.yml
+++ b/.github/workflows/test-claude-auto-review.yml
@@ -16,15 +16,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
@@ -34,7 +34,7 @@ jobs:
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
       - name: Setup pnpm cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ${{ env.STORE_PATH }}
           key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -50,7 +50,7 @@ jobs:
         run: pnpm test:coverage
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: coverage-report
diff --git a/actions/deploy-ecs/action.yml b/actions/deploy-ecs/action.yml
index 7e1becc..6e944a6 100644
--- a/actions/deploy-ecs/action.yml
+++ b/actions/deploy-ecs/action.yml
@@ -30,7 +30,7 @@ runs:
   using: "composite"
   steps:
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         aws-access-key-id: ${{ inputs.aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
diff --git a/actions/deploy-terraform/action.yml b/actions/deploy-terraform/action.yml
index 7973789..f4d2f0a 100644
--- a/actions/deploy-terraform/action.yml
+++ b/actions/deploy-terraform/action.yml
@@ -62,15 +62,15 @@ runs:
   using: "composite"
   steps:
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v3
+      uses: hashicorp/setup-terraform@v4
       with:
         cli_config_credentials_token: ${{ inputs.tfc_token }}
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v7
       if: ${{ inputs.needs-python == 'true' }}
       with:
         python-version: ${{ inputs.python-version }}
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         aws-access-key-id: ${{ inputs.aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
@@ -94,7 +94,7 @@ runs:
         echo "::set-output name=workspace-id::$WORKSPACE_ID"
     - name: Setup SSH key
       if: ${{ inputs.ssh-key != '' }}
-      uses: webfactory/ssh-agent@v0.9.0
+      uses: webfactory/ssh-agent@v0.10.0
       with:
         ssh-private-key: ${{ inputs.ssh-key }}
     - name: Configure Terraform Variables
diff --git a/actions/fmt-check-terraform/action.yml b/actions/fmt-check-terraform/action.yml
index b42d620..113c7c5 100644
--- a/actions/fmt-check-terraform/action.yml
+++ b/actions/fmt-check-terraform/action.yml
@@ -10,7 +10,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v3
+      uses: hashicorp/setup-terraform@v4
     - name: Terraform fmt
       env:
         TERRAFORM_PATH: ${{ inputs.terraform-path }}
diff --git a/actions/plan-terraform/action.yml b/actions/plan-terraform/action.yml
index 20dea23..8893f9d 100644
--- a/actions/plan-terraform/action.yml
+++ b/actions/plan-terraform/action.yml
@@ -74,14 +74,14 @@ runs:
   using: "composite"
   steps:
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v3
-    - uses: actions/setup-python@v5
+      uses: hashicorp/setup-terraform@v4
+    - uses: actions/setup-python@v7
       if: ${{ inputs.needs-python == 'true' }}
       with:
         python-version: ${{ inputs.python-version }}
         cli_config_credentials_token: ${{ inputs.tfc_token }}
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         aws-access-key-id: ${{ inputs.aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
@@ -103,7 +103,7 @@ runs:
         echo "key=$KEY" >> $GITHUB_OUTPUT
     - name: Setup SSH key
       if: ${{ inputs.ssh-key != '' }}
-      uses: webfactory/ssh-agent@v0.9.0
+      uses: webfactory/ssh-agent@v0.10.0
       with:
         ssh-private-key: ${{ inputs.ssh-key }}
     - name: Configure Terraform Variables
diff --git a/aws/ecs/deploy-image/action.yml b/aws/ecs/deploy-image/action.yml
index c8ad3d9..59c3b41 100644
--- a/aws/ecs/deploy-image/action.yml
+++ b/aws/ecs/deploy-image/action.yml
@@ -25,7 +25,7 @@ runs:
   using: "composite"
   steps:
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         aws-region: ${{ inputs.aws-region }}
diff --git a/aws/ecs/get-task-image/action.yml b/aws/ecs/get-task-image/action.yml
index 6e348c8..bff5183 100644
--- a/aws/ecs/get-task-image/action.yml
+++ b/aws/ecs/get-task-image/action.yml
@@ -30,7 +30,7 @@ runs:
   using: "composite"
   steps:
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         role-to-assume: ${{ inputs.aws-role-arn }}
         aws-region: ${{ inputs.aws-region }}
diff --git a/github/latest_release/action.yml b/github/latest_release/action.yml
index 8400668..5ac5deb 100644
--- a/github/latest_release/action.yml
+++ b/github/latest_release/action.yml
@@ -18,7 +18,7 @@ runs:
 
     - name: Get release value
       id: get_value
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       env:
         LATEST_TAG: ${{ steps.latest_release.outputs.release }}
       with:
diff --git a/github/paths-filter/action.yml b/github/paths-filter/action.yml
index b422ffb..b28950b 100644
--- a/github/paths-filter/action.yml
+++ b/github/paths-filter/action.yml
@@ -30,7 +30,7 @@ runs:
   using: composite
 
   steps:
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@v4
       id: filter
       with:
         filters: |
diff --git a/github/update-release-version/action.yml b/github/update-release-version/action.yml
index 9d2e4ef..37c3a51 100644
--- a/github/update-release-version/action.yml
+++ b/github/update-release-version/action.yml
@@ -36,7 +36,7 @@ runs:
       run: cog changelog --at ${{ steps.release.outputs.version }} -t full_hash > GITHUB_CHANGELOG.md
 
     - name: Update GitHub release notes
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v3
       with:
         body_path: GITHUB_CHANGELOG.md
         tag_name: ${{ steps.release.outputs.version }}
diff --git a/github/update-rust-version/action.yml b/github/update-rust-version/action.yml
index 8250f5d..7b8b115 100644
--- a/github/update-rust-version/action.yml
+++ b/github/update-rust-version/action.yml
@@ -49,7 +49,7 @@ runs:
         git remote set-url origin https://x-access-token:${{ inputs.token }}@github.com/${{ github.repository }}
 
     - name: Commit version bump
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@v7
       with:
         commit_message: "chore: Bump version for release"
         file_pattern: "Cargo.toml Cargo.lock"
@@ -71,7 +71,7 @@ runs:
       run: cog changelog --at ${{ steps.release.outputs.version }} -t full_hash > GITHUB_CHANGELOG.md
 
     - name: Update GitHub release notes
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v3
       with:
         body_path: GITHUB_CHANGELOG.md
         tag_name: ${{ steps.release.outputs.version }}
diff --git a/maestro/permit2-reset/action.yml b/maestro/permit2-reset/action.yml
index 5f32c12..7d7e4a7 100644
--- a/maestro/permit2-reset/action.yml
+++ b/maestro/permit2-reset/action.yml
@@ -47,7 +47,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v7
       with:
         node-version: ${{ inputs.node-version }}
 
diff --git a/terraform/plan/action.yml b/terraform/plan/action.yml
index c5634bb..fea037d 100644
--- a/terraform/plan/action.yml
+++ b/terraform/plan/action.yml
@@ -51,13 +51,13 @@ runs:
         terraform -chdir=${{ inputs.terraform-path }} show -no-color /tmp/plan.tfplan > /tmp/plan.txt
         echo "output-file=/tmp/plan.txt" >> $GITHUB_OUTPUT
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       if: ${{ inputs.upload-plan-file == 'true' }}
       with:
         name: plan.tfplan
         path: ${{ steps.plan.outputs.plan-file }}
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       if: ${{ inputs.upload-output-file == 'true' }}
       with:
         name: plan.txt
@@ -65,7 +65,7 @@ runs:
 
     - name: Add Plan to PR
       if: ${{ github.event_name == 'pull_request' || inputs.add-output-to-pr == 'true' }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       env:
         PLAN_FILE: ${{ steps.plan.outputs.output-file }}
       with: