diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3968611..0af2720 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.25'
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e1eadc6..cb9986c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           path: cli
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: cli/go.mod
       - uses: github/codeql-action/init@v4
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 6977e64..cddf3e7 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -29,7 +29,7 @@ jobs:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: cli/go.mod
       - name: Generate coverage
@@ -47,7 +47,7 @@ jobs:
       # covered by a test (100%), and the project floor stays >=95%.
       # Tool: diff-cover (https://github.com/Bachmann1234/diff-cover).
       # ------------------------------------------------------------------
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index f3df79a..f4c822e 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -34,7 +34,7 @@ jobs:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: cli/go.mod
       - uses: golangci/golangci-lint-action@v9
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index b4c0956..5d0635b 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           path: cli
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: cli/go.mod
           check-latest: true
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index ecb52e6..3ede0cf 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   scan:
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 50850ab..0e6f8e9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,7 @@ jobs:
           fetch-tags: true
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
 
@@ -65,7 +65,7 @@ jobs:
 
       - name: Install syft (SBOM)
         # pinned: tag v0.20.0
-        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26
 
       - name: Run GoReleaser
         # pinned: tag v6.4.0
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 492d3ee..90c9ce5 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -15,5 +15,5 @@ jobs:
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v7
-      - uses: crate-ci/typos@v1.48.0
+      - uses: crate-ci/typos@v1.50.0
         continue-on-error: true  # warn-only — surface findings without blocking CI