diff --git a/.github/workflows/auth-contract-e2e.yml b/.github/workflows/auth-contract-e2e.yml
index bf77632..8fbf82b 100644
--- a/.github/workflows/auth-contract-e2e.yml
+++ b/.github/workflows/auth-contract-e2e.yml
@@ -68,9 +68,9 @@ jobs:
       RAW_WEB_ORIGIN: ${{ github.event.inputs.web_origin || github.event.client_payload.web_origin || '' }}
       TRIGGER: ${{ github.event_name }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -156,9 +156,9 @@ jobs:
       # this. Never the prod secret.
       E2E_JWT_SECRET: ${{ secrets.E2E_JWT_SECRET }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f080d56..eea2c64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fail if PR branch is behind its base branch
@@ -32,9 +32,9 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -80,9 +80,9 @@ jobs:
   playwright:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cf79dc6..6f76730 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 5a1220d..3f5fc2b 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -39,7 +39,7 @@ jobs:
       - name: Generate lcov coverage
         if: github.event_name == 'pull_request'
         run: npx vitest run --coverage --coverage.provider=v8 --coverage.reporter=lcov --coverage.reportsDirectory=coverage
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index cab871c..95c8e37 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -25,8 +25,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index a78594c..b2d99cd 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -55,9 +55,9 @@ jobs:
       RAW_API_URL: ${{ github.event.inputs.api_url || vars.E2E_LIVE_STAGING_API_URL || '' }}
       E2E_LIVE_RUN_ID: ${{ github.run_id }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/e2e-pr-smoke.yml b/.github/workflows/e2e-pr-smoke.yml
index ca28397..f6585c8 100644
--- a/.github/workflows/e2e-pr-smoke.yml
+++ b/.github/workflows/e2e-pr-smoke.yml
@@ -77,10 +77,10 @@ jobs:
             echo "RUN=1" >> "$GITHUB_ENV"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: env.RUN == '1'
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         if: env.RUN == '1'
         with:
           node-version: '22'
diff --git a/.github/workflows/e2e-prod.yml b/.github/workflows/e2e-prod.yml
index f73b724..4695ab0 100644
--- a/.github/workflows/e2e-prod.yml
+++ b/.github/workflows/e2e-prod.yml
@@ -95,10 +95,10 @@ jobs:
             echo "RUN=1" >> "$GITHUB_ENV"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: env.RUN == '1'
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         if: env.RUN == '1'
         with:
           node-version: '22'
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index 6f3b4c3..6c49054 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
diff --git a/.github/workflows/lighthouse.yml b/.github/workflows/lighthouse.yml
index 9c409da..8a16957 100644
--- a/.github/workflows/lighthouse.yml
+++ b/.github/workflows/lighthouse.yml
@@ -25,9 +25,9 @@ jobs:
   lighthouse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 2c07a4d..a9180db 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/size-limit.yml b/.github/workflows/size-limit.yml
index d5a0c26..55e56ad 100644
--- a/.github/workflows/size-limit.yml
+++ b/.github/workflows/size-limit.yml
@@ -18,8 +18,8 @@ jobs:
     # this to required.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 661d167..492d3ee 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
-      - uses: crate-ci/typos@v1.47.2
+      - uses: actions/checkout@v7
+      - uses: crate-ci/typos@v1.48.0
         continue-on-error: true  # warn-only — surface findings without blocking CI