diff --git a/.github/workflows/benchmark-release.yml b/.github/workflows/benchmark-release.yml
index c05c9b6..2539b6f 100644
--- a/.github/workflows/benchmark-release.yml
+++ b/.github/workflows/benchmark-release.yml
@@ -35,8 +35,8 @@ jobs:
       CODEROOK_LLM_API_KEY_ENV: CODEROOK_RELEASE_API_KEY
       CODEROOK_RELEASE_API_KEY: ${{ secrets[matrix.secret] }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -51,7 +51,7 @@ jobs:
           uv run python scripts/run_benchmark.py --suite release
           --report-only
           --output .benchmark-results/${{ matrix.route }}-${{ matrix.repeat }}
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: benchmark-${{ matrix.route }}-${{ matrix.repeat }}
@@ -65,14 +65,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
       - run: uv python install 3.12
       - run: uv sync --frozen
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: benchmark-*
           path: .benchmark-results/raw
@@ -94,7 +94,7 @@ jobs:
           --min-read-only-pass-rate 0.90
           --min-security-pass-rate 1.0
           --max-pass-rate-spread 0.10
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: benchmark-release-aggregate
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f468220..5c19873 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,9 +20,9 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -33,7 +33,7 @@ jobs:
       - name: Sync locked environment
         run: uv sync --frozen
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
diff --git a/.github/workflows/crash-recovery.yml b/.github/workflows/crash-recovery.yml
index 2715873..7039238 100644
--- a/.github/workflows/crash-recovery.yml
+++ b/.github/workflows/crash-recovery.yml
@@ -17,9 +17,9 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -37,7 +37,7 @@ jobs:
           --min-rate 0.95
           --output reports/crash-recovery.json
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: crash-recovery-${{ matrix.os }}
@@ -51,9 +51,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -65,7 +65,7 @@ jobs:
         run: uv sync --frozen
 
       - name: Download platform reports
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         continue-on-error: true
         with:
           pattern: crash-recovery-*
@@ -80,7 +80,7 @@ jobs:
           --min-rate 0.95
           --output reports/aggregate/crash-recovery-aggregate.json
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: crash-recovery-aggregate
diff --git a/.github/workflows/distribution.yml b/.github/workflows/distribution.yml
index 3666a21..5094daa 100644
--- a/.github/workflows/distribution.yml
+++ b/.github/workflows/distribution.yml
@@ -36,8 +36,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -45,7 +45,7 @@ jobs:
       - run: uv sync --frozen
       - run: uv build
       - run: uv run python scripts/smoke_wheel.py dist
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: wheel-${{ matrix.os }}
           path: dist/*
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - run: docker build --tag coderook:candidate .
       - run: docker run --rm coderook:candidate coderook --version
       - name: Container zero-credential Core, ping and TUI smoke
@@ -92,8 +92,8 @@ jobs:
             target: macos-arm64
             archive: coderook-macos-arm64.tar.gz
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -120,7 +120,7 @@ jobs:
         run: >-
           ./dist/coderook-${{ matrix.target }}/runtime/bin/python3.12
           ./scripts/smoke_installed_runtime.py
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: coderook-portable-${{ matrix.target }}
           path: dist/${{ matrix.archive }}
@@ -132,14 +132,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
       - run: uv python install 3.12
       - run: uv sync --frozen
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -156,7 +156,7 @@ jobs:
           --screenshot artifacts/vscode-approval.png
       - working-directory: editors/vscode
         run: npm run check && npm run package
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: coderook-vscode
           path: |
diff --git a/.github/workflows/mcp-interop.yml b/.github/workflows/mcp-interop.yml
index fdf46c4..2a430d5 100644
--- a/.github/workflows/mcp-interop.yml
+++ b/.github/workflows/mcp-interop.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -27,7 +27,7 @@ jobs:
         run: >-
           uv run --no-sync python scripts/run_mcp_official_interop.py
           --output-dir .interop-results/mcp
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: mcp-official-interop
           path: .interop-results/mcp/*
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 277c796..9c22d4b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,10 +23,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -54,7 +54,7 @@ jobs:
     env:
       IMAGE: ghcr.io/${{ github.repository }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/login-action@v4
         with:
           registry: ghcr.io
@@ -114,7 +114,7 @@ jobs:
           sbom-path: container-metadata/coderook-container.spdx.json
           push-to-registry: true
           create-storage-record: false
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: coderook-container
           path: container-metadata/*
@@ -130,7 +130,7 @@ jobs:
       name: pypi
       url: https://pypi.org/p/CodeRook
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: wheel-ubuntu-latest
           path: dist
@@ -147,22 +147,22 @@ jobs:
       attestations: write
       artifact-metadata: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - run: uv python install 3.12
       - run: uv sync --frozen
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: wheel-ubuntu-latest
           path: release
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: coderook-portable-*
           path: release
           merge-multiple: true
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: coderook-container
           path: release
diff --git a/.github/workflows/remote-evidence.yml b/.github/workflows/remote-evidence.yml
index 7c2dbe2..125cc60 100644
--- a/.github/workflows/remote-evidence.yml
+++ b/.github/workflows/remote-evidence.yml
@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -27,7 +27,7 @@ jobs:
           uv run python scripts/audit_github_release_evidence.py
           --repo "$GITHUB_REPOSITORY"
           --output reports/github-release-evidence.json
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: github-release-evidence
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 54c05c6..4648eee 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -20,8 +20,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Install Python
         run: uv python install 3.12
       - name: Sync locked environment
@@ -32,7 +32,7 @@ jobs:
           --output reports/sandbox-boundary-${{ runner.os }}.json
       - name: Upload sandbox evidence
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: sandbox-boundary-${{ runner.os }}
           path: reports/sandbox-boundary-${{ runner.os }}.json
@@ -47,7 +47,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
@@ -68,7 +68,7 @@ jobs:
       matrix:
         language: [python, javascript-typescript]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}