diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d9c2be9..1ca106a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,12 +12,12 @@ jobs:
 
     steps:
       - name: Checkout (with zstd submodule)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Set up JDK 25
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9c60b1c..6a1b2bf 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,12 +14,12 @@ jobs:
     environment: maven
     steps:
       - name: Checkout (with zstd submodule)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Set up JDK 25 with Maven Central publishing
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '25'
           distribution: 'zulu'
diff --git a/.github/workflows/release-smoke.yml b/.github/workflows/release-smoke.yml
index 6c63327..4bf572b 100644
--- a/.github/workflows/release-smoke.yml
+++ b/.github/workflows/release-smoke.yml
@@ -72,10 +72,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout (smoke sources only)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up JDK 25 (host)
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: ${{ matrix.distribution }}
           java-version: '25'
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 2b00bd7..d1365f3 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -14,14 +14,14 @@ jobs:
 
     steps:
       - name: Checkout (with zstd submodule)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
           # Full history needed for line-level blame / new-code computation.
           fetch-depth: 0
 
       - name: Set up JDK 25
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '25'
@@ -33,7 +33,7 @@ jobs:
           version: 0.16.0
 
       - name: Cache SonarCloud packages
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar