diff --git a/.github/workflows/auth-contract-e2e.yml b/.github/workflows/auth-contract-e2e.yml
index f2d079d..bf77632 100644
--- a/.github/workflows/auth-contract-e2e.yml
+++ b/.github/workflows/auth-contract-e2e.yml
@@ -196,7 +196,7 @@ jobs:
 
       - name: Upload round-trip trace on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: auth-roundtrip-trace-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 4b83bd5..5a1220d 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -24,7 +24,7 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm test -- --coverage
-      - uses: codecov/codecov-action@v6
+      - uses: codecov/codecov-action@v7
         if: always()
         with:
           fail_ci_if_error: false
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index 091fd97..a78594c 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload LIVE trace + ledger on failure
         if: failure() && env.RUN_LIVE == '1'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-live-trace-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/e2e-pr-smoke.yml b/.github/workflows/e2e-pr-smoke.yml
index 2618cdc..ca28397 100644
--- a/.github/workflows/e2e-pr-smoke.yml
+++ b/.github/workflows/e2e-pr-smoke.yml
@@ -166,7 +166,7 @@ jobs:
 
       - name: Upload trace on failure
         if: failure() && env.RUN == '1'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-pr-smoke-trace-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/e2e-prod.yml b/.github/workflows/e2e-prod.yml
index 92bf1b2..f73b724 100644
--- a/.github/workflows/e2e-prod.yml
+++ b/.github/workflows/e2e-prod.yml
@@ -204,7 +204,7 @@ jobs:
 
       - name: Upload LIVE trace + ledger on failure
         if: failure() && env.RUN == '1'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: e2e-prod-trace-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 24f1d38..661d167 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -15,5 +15,5 @@ jobs:
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v6
-      - uses: crate-ci/typos@v1.47.0
+      - uses: crate-ci/typos@v1.47.2
         continue-on-error: true  # warn-only — surface findings without blocking CI