diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5b3f8f..6bfaf14 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,8 +11,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
@@ -27,7 +27,7 @@ jobs:
       - name: Run e2e (extension host)
         run: xvfb-run -a npm run test:e2e
       - run: npx @vscode/vsce package --no-dependencies --out tfvc.vsix
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: tfvc-vsix
           path: tfvc.vsix
@@ -38,8 +38,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 28dfd81..829a28f 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -25,8 +25,8 @@ jobs:
     # main; that's what we want for "is the released extension still
     # working against the real server?"
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version: '24'
           cache: 'npm'