diff --git a/.github/workflows/crates-publish.yml b/.github/workflows/crates-publish.yml
index 785e86e0..72c04a9e 100644
--- a/.github/workflows/crates-publish.yml
+++ b/.github/workflows/crates-publish.yml
@@ -17,7 +17,7 @@ jobs:
     name: Verify release changelog
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: v${{ inputs.version }}
       - name: Require one matching SemVer entry
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: crates.io
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: v${{ inputs.version }}
       - name: Install pinned Rust toolchain
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 5f08e2c4..cdf99132 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -19,8 +19,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install MkDocs
diff --git a/.github/workflows/mcp-registry-publish.yml b/.github/workflows/mcp-registry-publish.yml
index f002f4cd..e9d9b4fd 100644
--- a/.github/workflows/mcp-registry-publish.yml
+++ b/.github/workflows/mcp-registry-publish.yml
@@ -17,7 +17,7 @@ jobs:
     name: Verify release changelog
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: v${{ inputs.version }}
       - name: Require one matching SemVer entry
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: mcp-registry
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: v${{ inputs.version }}
       - name: Verify requested version and OCI metadata
diff --git a/.github/workflows/native-publish.yml b/.github/workflows/native-publish.yml
index 058a8fd5..a9c90366 100644
--- a/.github/workflows/native-publish.yml
+++ b/.github/workflows/native-publish.yml
@@ -14,7 +14,7 @@ jobs:
     name: Verify release changelog
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
       - name: Require one matching SemVer entry
@@ -35,7 +35,7 @@ jobs:
     needs: [verification, changelog]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
       - name: Install pinned Rust toolchain
@@ -43,7 +43,7 @@ jobs:
         run: rustup show
       - name: Generate Cargo dependency notices
         run: ./scripts/generate-third-party-notices.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: asdecided-third-party-notices
           path: THIRD-PARTY-NOTICES
@@ -72,10 +72,10 @@ jobs:
             archive: zip
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: asdecided-third-party-notices
       - name: Install pinned Rust toolchain
@@ -111,7 +111,7 @@ jobs:
           Copy-Item rust/target/release/decided.exe,rust/target/release/decided-mcp.exe -Destination package
           Compress-Archive -Path package\* -DestinationPath dist/asdecided-${{ matrix.target }}.zip
       - name: Attest release archive
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: dist/asdecided-${{ matrix.target }}.${{ matrix.archive }}
       - name: Attach binaries to GitHub Release
@@ -129,7 +129,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
       - name: Download release archives
@@ -164,11 +164,11 @@ jobs:
           RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: gh release upload "$RELEASE_TAG" "dist/asdecided-${RELEASE_TAG}-sbom.cdx.json" --repo "$GITHUB_REPOSITORY" --clobber
       - name: Attest SHA256SUMS
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: dist/SHA256SUMS
       - name: Attest CycloneDX SBOM
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: dist/asdecided-${{ github.event.release.tag_name }}-sbom.cdx.json
 
@@ -183,10 +183,10 @@ jobs:
       IMAGE: ghcr.io/asdecided/core
       TAG: ${{ github.event.release.tag_name }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: asdecided-third-party-notices
       - name: Build and smoke-test CLI image
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 0a323375..12e3887a 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -16,7 +16,7 @@ jobs:
     name: release changelog contract
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Verify current version has one changelog entry
         run: |
           VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided") | .version')"
@@ -29,7 +29,7 @@ jobs:
     name: watchkeeper (dogfood, native)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -49,7 +49,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -73,7 +73,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -93,7 +93,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -139,7 +139,7 @@ jobs:
     name: public docs and guidance drift
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Build native AsDecided
         working-directory: rust
@@ -156,7 +156,7 @@ jobs:
     name: mcp distribution metadata
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Verify Registry and OCI metadata agree
         run: |
           WORKSPACE_VERSION="$(cargo metadata --manifest-path rust/Cargo.toml --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "decided-mcp") | .version')"
diff --git a/.github/workflows/rac-localview-build.yml b/.github/workflows/rac-localview-build.yml
index d922ec9d..a4354928 100644
--- a/.github/workflows/rac-localview-build.yml
+++ b/.github/workflows/rac-localview-build.yml
@@ -25,9 +25,9 @@ jobs:
       run:
         working-directory: rac-localview
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
@@ -59,7 +59,7 @@ jobs:
 
       # Upload only — no deploy (GATE-1).
       - name: Upload site artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: rac-localview-dist
           path: rac-localview/dist/
diff --git a/.github/workflows/rust-spike.yml b/.github/workflows/rust-spike.yml
index 39d5f846..fc9210fd 100644
--- a/.github/workflows/rust-spike.yml
+++ b/.github/workflows/rust-spike.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 
@@ -74,7 +74,7 @@ jobs:
     runs-on: macos-15
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 
@@ -112,11 +112,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
@@ -146,7 +146,7 @@ jobs:
         run: cargo clippy --release --no-deps -- -D warnings
 
       - name: Checkout authoritative asdecided-spec fixtures
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: asdecided/spec
           path: asdecided-spec
@@ -179,7 +179,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 
diff --git a/.github/workflows/watchkeeper.yml b/.github/workflows/watchkeeper.yml
index 4dbd825b..9a01ede6 100644
--- a/.github/workflows/watchkeeper.yml
+++ b/.github/workflows/watchkeeper.yml
@@ -44,7 +44,7 @@ jobs:
     name: watchkeeper
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           # The comparison needs the base revision's history.
           fetch-depth: 0