diff --git a/.github/workflows/catalog-refresh.yml b/.github/workflows/catalog-refresh.yml
index 484ef94..0627c0a 100644
--- a/.github/workflows/catalog-refresh.yml
+++ b/.github/workflows/catalog-refresh.yml
@@ -50,7 +50,7 @@ jobs:
           echo "::notice::Catalog lists $count reference(s)."
 
       - name: Open a PR when the catalog drifted
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           add-paths: |
             docs/usage-catalog.md
diff --git a/.github/workflows/reusable-sf-org-deploy.yml b/.github/workflows/reusable-sf-org-deploy.yml
index 5091cd7..ae9e372 100644
--- a/.github/workflows/reusable-sf-org-deploy.yml
+++ b/.github/workflows/reusable-sf-org-deploy.yml
@@ -104,7 +104,7 @@ jobs:
       mode: ${{ steps.plan.outputs.mode }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
@@ -266,7 +266,7 @@ jobs:
           ' >&2
           exit 1
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: steps.gate.outputs.skip != 'true'
         with:
           name: ${{ steps.build.outputs.artifact-name }}
@@ -295,7 +295,7 @@ jobs:
     # No actions/checkout, deliberately: this job must not be able to rebuild
     # what it deploys. See docs/org-deploy-engine.md.
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: ${{ needs.build.outputs.artifact-name }}
           path: artifact
diff --git a/.github/workflows/smoke-sf-artifact.yml b/.github/workflows/smoke-sf-artifact.yml
index 66df720..2505eef 100644
--- a/.github/workflows/smoke-sf-artifact.yml
+++ b/.github/workflows/smoke-sf-artifact.yml
@@ -48,7 +48,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the actions under test
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Build a throwaway sfdx project
         run: |
@@ -201,7 +201,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Build a fixture whose replacement env var is never set
         run: |
@@ -276,7 +276,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Build a minimal artifact directory by hand
         run: |
@@ -331,7 +331,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Build a valid artifact directory
         run: |
diff --git a/.github/workflows/smoke-sf-org-login.yml b/.github/workflows/smoke-sf-org-login.yml
index 3932716..ce77957 100644
--- a/.github/workflows/smoke-sf-org-login.yml
+++ b/.github/workflows/smoke-sf-org-login.yml
@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: Check out the action under test
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Attempt the login
         id: attempt
@@ -115,7 +115,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Attempt a login with base64 that is not a PEM key
         id: attempt
@@ -144,7 +144,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Regression guard: adding credential-source must not have altered the
       # historical auth-url branch, whose default is unrelated to JWT.