diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 568cd6570..7f37a75bb 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index e0d439ef4..bacd76471 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index f5f6cf166..dd752288f 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -12,10 +12,10 @@ jobs:
     name: Build Frontend Assets
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
@@ -51,7 +51,7 @@ jobs:
       env:
         CABAL_DIR: /root/.cabal
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download frontend artifacts
         uses: actions/download-artifact@v8
@@ -60,7 +60,7 @@ jobs:
           path: static/public/assets
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: cli-linux-x64-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}-${{ github.sha }}
@@ -98,7 +98,7 @@ jobs:
       env:
         CABAL_DIR: /root/.cabal
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download frontend artifacts
         uses: actions/download-artifact@v8
@@ -107,7 +107,7 @@ jobs:
           path: static/public/assets
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: cli-linux-arm64-dist-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}-${{ github.sha }}
@@ -146,7 +146,7 @@ jobs:
           - arch: x86_64
             runner: macos-15-intel
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download frontend artifacts
         uses: actions/download-artifact@v8
@@ -165,14 +165,14 @@ jobs:
           cabal-version: '3.14'
 
       - name: Cache Cabal
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.cabal
           key: cli-macos-${{ matrix.arch }}-cabal-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}
           restore-keys: cli-macos-${{ matrix.arch }}-cabal-
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: cli-macos-${{ matrix.arch }}-dist-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}
@@ -219,7 +219,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Download all artifacts
         uses: actions/download-artifact@v8
diff --git a/.github/workflows/deps-image.yml b/.github/workflows/deps-image.yml
index 81affc392..6a67639b3 100644
--- a/.github/workflows/deps-image.yml
+++ b/.github/workflows/deps-image.yml
@@ -30,7 +30,7 @@ jobs:
           - platform: linux/arm64
             runner: blacksmith-4vcpu-ubuntu-2404-arm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Free Disk Space
         run: |
@@ -41,7 +41,7 @@ jobs:
           sudo docker image prune --all --force
 
       - name: Setup Blacksmith Builder
-        uses: useblacksmith/setup-docker-builder@v1
+        uses: useblacksmith/setup-docker-builder@v2
 
       - name: Login to Container Registry
         uses: docker/login-action@v4
diff --git a/.github/workflows/fourmolu.yml b/.github/workflows/fourmolu.yml
index d3bde9eb5..71d965a23 100644
--- a/.github/workflows/fourmolu.yml
+++ b/.github/workflows/fourmolu.yml
@@ -14,13 +14,13 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Cache fourmolu
         id: cache-fourmolu
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.local/bin/fourmolu
           key: fourmolu-0.19.0.0
diff --git a/.github/workflows/haskell.yml b/.github/workflows/haskell.yml
index 8465dce39..e218bc95c 100644
--- a/.github/workflows/haskell.yml
+++ b/.github/workflows/haskell.yml
@@ -14,10 +14,10 @@ jobs:
     name: Build Frontend
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -118,10 +118,10 @@ jobs:
           TIMEFUSION_BUFFER_MAX_MEMORY_MB: '512'
           OTEL_TRACES_EXPORTER: none
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: ${{ runner.os }}-container-cabal-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}-${{ github.sha }}
@@ -205,10 +205,10 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Blacksmith Builder
-        uses: useblacksmith/setup-docker-builder@v1
+        uses: useblacksmith/setup-docker-builder@v2
 
       - name: Login to Container Registry
         uses: docker/login-action@v4
diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml
index d5b5e6fb9..42efe4d81 100644
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -11,10 +11,10 @@ jobs:
     name: Build Frontend
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -113,10 +113,10 @@ jobs:
           TIMEFUSION_BUFFER_MAX_MEMORY_MB: '512'
           OTEL_TRACES_EXPORTER: none
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Cache dist-newstyle
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: dist-newstyle
           key: ${{ runner.os }}-container-cabal-${{ hashFiles('**/*.cabal', '**/cabal.project*') }}-${{ github.sha }}
@@ -215,7 +215,7 @@ jobs:
       # Pin to the PR head SHA instead of head_ref: head_ref is the branch
       # name, which checkout fetches with a glob refspec that 404s on deleted
       # or fork branches (see i18n-yaml PR fetch failure).
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -249,9 +249,9 @@ jobs:
     name: UI Tests
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'