diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31f2a92..bd2be51 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,10 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -97,7 +97,7 @@ jobs:
             fetch_depth: 0
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: ${{ matrix.fetch_depth }}
 
@@ -158,10 +158,10 @@ jobs:
           - plugin: fchub-wishlist
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -170,7 +170,7 @@ jobs:
 
       - name: Upload rejected package evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}-failure
           path: |
@@ -183,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # `Check for changes` below diffs against the pull request base, which
           # a depth-1 checkout does not contain: the diff fails, the count comes
@@ -199,7 +199,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -222,7 +222,7 @@ jobs:
 
       - name: Cache Playwright browsers
         if: steps.changes.outputs.count > 0
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('plugins/fchub-memberships/package-lock.json') }}
@@ -264,7 +264,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # `Check for changes` below diffs against the pull request base, which
           # a depth-1 checkout does not contain: the diff fails, the count comes
@@ -280,7 +280,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -320,7 +320,7 @@ jobs:
       # job remains because the repository asserts Stream is still here for a
       # possible return, not because anything is expected to run.
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check for changes
         id: changes
@@ -330,7 +330,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
@@ -385,10 +385,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
diff --git a/.github/workflows/claude-interactive.yml b/.github/workflows/claude-interactive.yml
index 65f4caf..46e5e3c 100644
--- a/.github/workflows/claude-interactive.yml
+++ b/.github/workflows/claude-interactive.yml
@@ -27,7 +27,7 @@ jobs:
       group: claude-interactive-${{ github.event.issue.number || github.event.pull_request.number }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -39,7 +39,7 @@ jobs:
           coverage: none
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 0bfa962..70cfd37 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -22,7 +22,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index 372b088..11198b6 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -81,9 +81,9 @@ jobs:
     name: Version Consistency
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
 
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 454cb8e..3e2f81e 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -35,7 +35,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run Claude Code
         uses: anthropics/claude-code-action@v1
diff --git a/.github/workflows/mcp-docker.yml b/.github/workflows/mcp-docker.yml
index d52f6a7..5fe4722 100644
--- a/.github/workflows/mcp-docker.yml
+++ b/.github/workflows/mcp-docker.yml
@@ -163,12 +163,12 @@ jobs:
         with:
           name: ${{ env.IMAGE_ARTIFACT }}
       - run: docker load -i image.tar
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/mcp-promote.yml b/.github/workflows/mcp-promote.yml
index 2cb00c8..f9463b7 100644
--- a/.github/workflows/mcp-promote.yml
+++ b/.github/workflows/mcp-promote.yml
@@ -125,12 +125,12 @@ jobs:
           DOCKERHUB_ACTUAL=$(docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:${VERSION}" --format '{{json .Manifest.Digest}}' | tr -d '"')
           test "$GHCR_ACTUAL" = "$GHCR_EXPECTED"
           test "$DOCKERHUB_ACTUAL" = "$DOCKERHUB_EXPECTED"
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@v4.5.2
+      - uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4f0ba09..b939e23 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
       is_wporg: ${{ steps.tag.outputs.is_wporg }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -96,12 +96,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout validated tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -165,7 +165,7 @@ jobs:
 
       - name: Download validated WordPress.org ZIP
         if: needs.prepare.outputs.is_wporg == 'true'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: wporg-package-${{ needs.prepare.outputs.slug }}
           path: dist
diff --git a/.github/workflows/wporg-release-gates.yml b/.github/workflows/wporg-release-gates.yml
index c040d4d..8b81f2e 100644
--- a/.github/workflows/wporg-release-gates.yml
+++ b/.github/workflows/wporg-release-gates.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate target and version
         env:
@@ -64,7 +64,7 @@ jobs:
           - '8.5'
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -95,10 +95,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm
@@ -149,12 +149,12 @@ jobs:
           - fchub-wishlist
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -184,7 +184,7 @@ jobs:
             "${{ matrix.plugin }}"
 
       - name: Upload validated package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}
           path: |
@@ -196,7 +196,7 @@ jobs:
 
       - name: Upload rejected package evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}-failure
           path: |
@@ -226,10 +226,10 @@ jobs:
           - '8.5'
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download validated package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: wporg-package-${{ matrix.plugin }}
           path: dist
@@ -273,7 +273,7 @@ jobs:
 
       - name: Upload disposable gate evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-runtime-${{ matrix.plugin }}-php${{ matrix.php_version }}-failure
           path: test-results/wporg/${{ matrix.plugin }}/