diff --git a/.github/workflows/auth-contract-compose-pw.yml b/.github/workflows/auth-contract-compose-pw.yml
index 108e659f..e092e831 100644
--- a/.github/workflows/auth-contract-compose-pw.yml
+++ b/.github/workflows/auth-contract-compose-pw.yml
@@ -69,7 +69,7 @@ jobs:
           path: common
 
       - name: Set up Node (for Playwright)
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'npm'
@@ -182,7 +182,7 @@ jobs:
 
       - name: Upload gate-fired signal artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: auth-contract-gate-signal
           path: /tmp/gate-signal/auth-contract-compose.jsonl
@@ -190,7 +190,7 @@ jobs:
 
       - name: Upload Playwright report on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-report-auth-contract-layer2
           path: api/e2e/browser/playwright-report/
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 90391547..24f1d38b 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -15,5 +15,5 @@ jobs:
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v6
-      - uses: crate-ci/typos@v1.46.3
+      - uses: crate-ci/typos@v1.47.0
         continue-on-error: true  # warn-only — surface findings without blocking CI