diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 9b1a844..ad56e23 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -18,6 +18,8 @@ jobs:
       pull-requests: write
     if: github.actor == 'renovate[bot]' || github.event_name == 'workflow_dispatch'
     steps:
+      # Pinned to v4: hmarr/auto-approve-action has no Node 24 release yet.
+      # Accept the Node 20 deprecation warning until upstream publishes a new version.
       - uses: hmarr/auto-approve-action@v4
         with:
           review-message: "Auto approved automated PR"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 108d492..ac20b29 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Deno
         uses: denoland/setup-deno@v2
@@ -45,7 +45,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Deno
         uses: denoland/setup-deno@v2
@@ -56,7 +56,7 @@ jobs:
         run: deno task build:linux:x64
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: stackctl-linux-x64
           path: dist/stackctl-linux-x64
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 81bbb80..faa4172 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,14 +22,14 @@ jobs:
             os: macos-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       
       - uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
       
       - name: Cache Deno dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/deno
@@ -50,7 +50,7 @@ jobs:
         working-directory: dist
         run: shasum -a 256 "stackctl-${{ github.ref_name }}-${{ matrix.target }}.tar.gz" > "stackctl-${{ github.ref_name }}-${{ matrix.target }}.tar.gz.sha256"
       
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: ${{ matrix.target }}
           path: |
@@ -64,9 +64,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           pattern: "*"
           path: dist/
@@ -77,7 +77,7 @@ jobs:
         run: shasum -a 256 stackctl-*.tar.gz > checksums.txt
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             dist/stackctl-*.tar.gz
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 5af36f0..ba4b924 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           stale-issue-label: ":sleeping: stale"
           stale-issue-message: >
diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
index b765764..9971148 100644
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -21,7 +21,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: main