diff --git a/.github/workflows/api-contract.yml b/.github/workflows/api-contract.yml
index 4b96cbb1d..ca7369a76 100644
--- a/.github/workflows/api-contract.yml
+++ b/.github/workflows/api-contract.yml
@@ -28,7 +28,7 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 7a63b6484..afc0108d2 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -68,25 +68,25 @@ jobs:
     name: Build + push (${{ github.event_name }})
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # buildx is the multi-platform driver. qemu provides the cross-arch
       # emulation that lets the amd64 GitHub-hosted runner produce an
       # arm64 image. The cost is roughly +2x build time on the arm64
       # leg vs native; acceptable for the release-only publish cadence.
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: linux/arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # GHCR push needs the actor's PAT — for actions/github-token, the
       # token's `packages: write` permission is granted by the job-level
       # `permissions:` block above.
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -103,7 +103,7 @@ jobs:
       # — a push or workflow_dispatch from main cannot claim it.
       - name: Compute image metadata (tags + labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -130,7 +130,7 @@ jobs:
       # rate; tag rebuilds still amortise across workflow_dispatch.
       - name: Build + push
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile.prod
@@ -153,7 +153,7 @@ jobs:
       # not the mutable tag — so a future re-tag doesn't invalidate the
       # signature).
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
         with:
           cosign-release: 'v2.4.1'
 
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
index 960288bbe..de513e753 100644
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -31,10 +31,10 @@ jobs:
         working-directory: docs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           # Astro 6 requires Node >=22.12; 20 trips an EBADENGINE on `npm
           # ci` and a hard "Node.js v20 is not supported by Astro!" on
@@ -59,7 +59,7 @@ jobs:
       # because docs-deploy-trigger.yml is the production path.
       - name: Upload build artifact
         if: success()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: docs-dist
           path: docs/dist/
diff --git a/.github/workflows/docs-screenshots-build.yml b/.github/workflows/docs-screenshots-build.yml
index 357a87850..e3c39b04d 100644
--- a/.github/workflows/docs-screenshots-build.yml
+++ b/.github/workflows/docs-screenshots-build.yml
@@ -38,10 +38,10 @@ jobs:
         working-directory: docs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           # Astro 6 requires Node >=22.12; mirrors the bump in
           # docs-build.yml that landed with the docs astro+starlight
diff --git a/.github/workflows/docs-screenshots-capture.yml b/.github/workflows/docs-screenshots-capture.yml
index 71f8ae400..339e3bdb1 100644
--- a/.github/workflows/docs-screenshots-capture.yml
+++ b/.github/workflows/docs-screenshots-capture.yml
@@ -129,7 +129,7 @@ jobs:
       # PR's base branch (effectively `main`). All `npm ci` postinstall
       # hooks run against this tree, NEVER against the PR head.
       - name: Checkout trusted code from base branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.base.sha || github.sha }}
           path: trusted
@@ -150,7 +150,7 @@ jobs:
       # canonical shape means a future change to the gate (e.g. opt-in
       # fork support) doesn't silently break the push.
       - name: Checkout PR head (docker stack + screenshot output dir)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.head_ref || github.ref_name }}
@@ -158,7 +158,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           # Astro 6 requires Node >=22.12; mirrors the bump in
           # docs-build.yml that landed with the docs astro+starlight
@@ -316,7 +316,7 @@ jobs:
       # changed under the file_pattern.
       - name: Commit captured screenshots back to PR branch
         if: github.event_name != 'workflow_dispatch'
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           repository: pr-head
           commit_message: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index af3dcf664..c9ad39f6a 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -29,7 +29,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Bring up the same stack a developer gets locally via
       # `./sbpp.sh up`. CI owns the runner, so no override file is
@@ -73,7 +73,7 @@ jobs:
       # together cover almost every "what failed and why" question.
       - name: Upload Playwright report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-report
           path: web/tests/e2e/playwright-report/
@@ -82,7 +82,7 @@ jobs:
 
       - name: Upload Playwright test-results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-test-results
           path: web/tests/e2e/test-results/
diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index e7949bca1..96656a63e 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -41,7 +41,7 @@ jobs:
           --health-retries=10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -56,7 +56,7 @@ jobs:
         run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('web/composer.lock') }}
diff --git a/.github/workflows/plugin-build.yml b/.github/workflows/plugin-build.yml
index 2d95e67ed..e25ee6bce 100644
--- a/.github/workflows/plugin-build.yml
+++ b/.github/workflows/plugin-build.yml
@@ -25,7 +25,7 @@ jobs:
     name: Compile SourceMod plugins
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup SourcePawn compiler
         uses: rumblefrog/setup-sp@master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4721e514d..62233d8a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     needs: validate
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup SourcePawn compiler
         uses: rumblefrog/setup-sp@master
@@ -106,7 +106,7 @@ jobs:
               exit 1
           fi
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: plugin
           path: sourcebans-pp-${{ github.ref_name }}.plugin-only.tar.gz
@@ -117,7 +117,7 @@ jobs:
     needs: validate
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Composer is run against the staged tree (NOT the source checkout)
       # so the source checkout stays clean and the resulting vendor/
@@ -217,7 +217,7 @@ jobs:
               exit 1
           fi
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: webpanel
           path: sourcebans-pp-${{ github.ref_name }}.webpanel-only.zip
@@ -231,12 +231,12 @@ jobs:
       contents: write
       actions: read
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: assets
           merge-multiple: true
 
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3e9eeb444..2d14d2afd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -37,7 +37,7 @@ jobs:
           --health-retries=10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -52,7 +52,7 @@ jobs:
         run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache composer dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('web/composer.lock') }}
diff --git a/.github/workflows/ts-check.yml b/.github/workflows/ts-check.yml
index 13e512233..7452d9b02 100644
--- a/.github/workflows/ts-check.yml
+++ b/.github/workflows/ts-check.yml
@@ -20,10 +20,10 @@ jobs:
       run:
         working-directory: web
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'