diff --git a/.github/workflows/stackradar-ci.yml b/.github/workflows/stackradar-ci.yml
index 2c3b9b3..c14c5bb 100644
--- a/.github/workflows/stackradar-ci.yml
+++ b/.github/workflows/stackradar-ci.yml
@@ -14,8 +14,8 @@ jobs:
     name: Lint + type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
       - name: Lockfile is in sync with pyproject.toml
         run: uv lock --check
       - name: Install pinned dev tools from uv.lock
@@ -36,8 +36,8 @@ jobs:
         python: ["3.9", "3.12"]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
         with:
           python-version: ${{ matrix.python }}
       - name: Install pinned test tools from uv.lock
@@ -54,7 +54,7 @@ jobs:
           echo '```' >> "$GITHUB_STEP_SUMMARY"
       - name: Upload coverage to Codecov
         if: matrix.os == 'ubuntu-latest' && matrix.python == '3.12'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           files: coverage.xml
           # Public repos need a (free) token: add it as the CODECOV_TOKEN repository secret.
diff --git a/.github/workflows/stackradar-pages.yml b/.github/workflows/stackradar-pages.yml
index ef0a1b1..5d31293 100644
--- a/.github/workflows/stackradar-pages.yml
+++ b/.github/workflows/stackradar-pages.yml
@@ -24,11 +24,11 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: docs/build_site.sh _site
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@v6
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: _site
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/stackradar-release.yml b/.github/workflows/stackradar-release.yml
index 8cffbc3..1c854d6 100644
--- a/.github/workflows/stackradar-release.yml
+++ b/.github/workflows/stackradar-release.yml
@@ -33,7 +33,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - id: v
         name: Is there a version to release?
         run: |
@@ -54,8 +54,8 @@ jobs:
     needs: check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with: { python-version: "3.12" }
       - run: python -m unittest discover -s tests -v
 
@@ -69,7 +69,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       V: ${{ needs.check.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: python3 scripts/release_notes.py
       - name: Draft release
         run: |
@@ -110,7 +110,7 @@ jobs:
       APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
       APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Python (macOS — universal2 from python.org so one backend runs on Intel + Apple silicon)
         if: runner.os == 'macOS'
@@ -121,7 +121,7 @@ jobs:
           echo "DR_UNIVERSAL=1" >> "$GITHUB_ENV"
       - name: Python (Windows / Linux)
         if: runner.os != 'macOS'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with: { python-version: "3.12" }
       - name: PyInstaller
         run: |
@@ -129,7 +129,7 @@ jobs:
           "$PY" -m pip install --upgrade pip pyinstaller
           echo "PYTHON=$PY" >> "$GITHUB_ENV"
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -154,7 +154,7 @@ jobs:
           if [[ "${{ runner.os }}" == "macOS" && -z "$CSC_LINK" ]]; then EXTRA="-c.mac.identity=-"; fi
           npx electron-builder ${{ matrix.target }} --publish "$PUB" $EXTRA
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: stackradar-${{ runner.os }}
           path: |
@@ -175,8 +175,8 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           pattern: stackradar-*
diff --git a/.github/workflows/stackradar-wiki.yml b/.github/workflows/stackradar-wiki.yml
index 08e3169..797bb0f 100644
--- a/.github/workflows/stackradar-wiki.yml
+++ b/.github/workflows/stackradar-wiki.yml
@@ -14,7 +14,7 @@ jobs:
   wiki:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Clone the wiki
         run: git clone "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.wiki.git" _wiki
       - name: Build pages