diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index f25badf..32871ad 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -170,8 +170,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           # The fleet Python — tests/test_python_version.py pins this literal
           # against the Dockerfile's FROM tag.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c52f853..94abd95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,8 +62,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           # The fleet Python — tests/test_python_version.py pins every
           # encoding of it (Dockerfile FROM tag, matrix main, render.yaml,
@@ -138,9 +138,9 @@ jobs:
             backend: flask
             dash: "4.4.0"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python }}
           cache: pip
@@ -228,14 +228,14 @@ jobs:
     timeout-minutes: 25
     needs: [test]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The same build Render runs. This is where a dependency-resolution
       # failure surfaces — at CI time, not deploy time, where the only signal
       # is a dashboard log while the old image keeps serving.
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
       - name: Build the production image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           tags: llms-2plot-dev:ci
@@ -341,8 +341,8 @@ jobs:
     # 2am. The report is the value; flip this off once the baseline is quiet.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
       - run: pip install pip-audit