diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 65cab05..1b5f5cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
   shell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: bash syntax check
         run: |
@@ -24,8 +24,8 @@ jobs:
   python:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
 
@@ -44,7 +44,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Test plugin build
         run: |
@@ -52,7 +52,7 @@ jobs:
           ./build-plugin.sh
 
       - name: Upload zip artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: findgcp-plugin-zip
           path: dist/findgcp-*.zip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb343f4..abea909 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
   build-and-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Verify tag matches manifest version
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 435a30e..ad0aca3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   Lint-only; the helper script is not part of the plugin zip, so the published
   `1.1.2` artifact is unchanged.
 
+### Changed
+- CI: bumped GitHub Actions off the deprecated Node.js 20 runtime —
+  `actions/checkout@v4 → v6`, `actions/setup-python@v5 → v6`,
+  `actions/upload-artifact@v4 → v7`. Workflow-only; no effect on the plugin.
+
 ## [1.1.2] - 2026-06-11
 
 Robustness fixes from a second code review. The version bump also re-busts the