diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3fd1145..3aedfbe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           # >=22 required: the `test` script uses --test-coverage-exclude,
           # which Node added in 22.5.0. On Node 20 it errors with
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cf79dc6..6f76730 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7a158d5..3f83a4b 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           # >=22 for --test-coverage-exclude support (added 22.5.0).
           node-version: 22
@@ -65,7 +65,7 @@ jobs:
             dist-test/test/input-hardening-unit.test.js \
             dist-test/test/deploy-id-schema-unit.test.js \
             dist-test/test/error-contract-unit.test.js
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index 6f3b4c3..6c49054 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 2c07a4d..a9180db 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e5c4525..1d01d8c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,9 +19,9 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 661d167..492d3ee 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
-      - uses: crate-ci/typos@v1.47.2
+      - uses: actions/checkout@v7
+      - uses: crate-ci/typos@v1.48.0
         continue-on-error: true  # warn-only — surface findings without blocking CI