diff --git a/.github/workflows/commit_lint.yaml b/.github/workflows/commit_lint.yaml
index 6f22d66..c5acb0a 100644
--- a/.github/workflows/commit_lint.yaml
+++ b/.github/workflows/commit_lint.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 🛸 Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: 🎯 Validate Commit Messages
         uses: wagoid/commitlint-github-action@v6
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index 1b8751d..a279741 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -13,12 +13,12 @@ jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
           cache: true
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: Resolve workspace dependencies
@@ -31,7 +31,7 @@ jobs:
         run: python3 tools/coverage.py
       - name: Save test logs and coverage reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: workspace-coverage
           path: |
@@ -44,19 +44,19 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "21"
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.x"
       - name: Require 100% native permission-plugin coverage
         run: python3 plugins/contact_permission/native_tests/run.py
       - name: Save native coverage reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: native-permission-coverage
           path: |
diff --git a/.github/workflows/nonstop-template.yml b/.github/workflows/nonstop-template.yml
index b1a0ff9..3b58cf3 100644
--- a/.github/workflows/nonstop-template.yml
+++ b/.github/workflows/nonstop-template.yml
@@ -14,7 +14,7 @@ jobs:
       run:
         working-directory: packages/nonstop_cli
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: '3.47.5'
@@ -33,7 +33,7 @@ jobs:
       run:
         working-directory: packages/nonstop_cli
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: subosito/flutter-action@v2
         with:
           flutter-version: '3.47.5'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 53ecd75..52e5c51 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,11 +21,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
       # setup-dart configures short-lived pub.dev OIDC credentials. Install
diff --git a/.github/workflows/release-failure.yml b/.github/workflows/release-failure.yml
index 8e5667e..3a750a7 100644
--- a/.github/workflows/release-failure.yml
+++ b/.github/workflows/release-failure.yml
@@ -26,11 +26,11 @@ jobs:
     steps:
       # workflow_run is privileged: execute only the default branch's reporter,
       # never scripts/artifacts checked out from the failed run's head SHA.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v9
         with:
           script: |
             const { reportFailure } = await import(`${process.env.GITHUB_WORKSPACE}/.github/scripts/release-failure.mjs`);
diff --git a/.github/workflows/release-tooling.yml b/.github/workflows/release-tooling.yml
index 0a70406..3743244 100644
--- a/.github/workflows/release-tooling.yml
+++ b/.github/workflows/release-tooling.yml
@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
       - run: node --test tools/release/*.test.mjs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83d0ee8..7c1546d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,18 +28,18 @@ jobs:
     steps:
       - name: Create release App token
         id: app
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
           permission-contents: write
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Read main when this serialized job starts, so queued merges accumulate.
           ref: main
           fetch-depth: 0
           token: ${{ steps.app.outputs.token }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
       - uses: subosito/flutter-action@v2