diff --git a/.github/workflows/enum-parity-header.yml b/.github/workflows/enum-parity-header.yml
index 532d39b..fa506df 100644
--- a/.github/workflows/enum-parity-header.yml
+++ b/.github/workflows/enum-parity-header.yml
@@ -40,18 +40,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out epaper-dithering
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # davelee98/opendisplay-protocol is public, so this needs no token and
       # no secret -- which is what lets the job be always-on for PRs from forks.
       - name: Check out canonical protocol repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: davelee98/opendisplay-protocol
           path: .protocol
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.11'
 
diff --git a/.github/workflows/ios-test.yml b/.github/workflows/ios-test.yml
index e2b724e..5dbf70d 100644
--- a/.github/workflows/ios-test.yml
+++ b/.github/workflows/ios-test.yml
@@ -28,7 +28,7 @@ jobs:
     name: Test (host FFI)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
diff --git a/.github/workflows/javascript-test.yml b/.github/workflows/javascript-test.yml
index e51fba5..a9556fa 100644
--- a/.github/workflows/javascript-test.yml
+++ b/.github/workflows/javascript-test.yml
@@ -27,7 +27,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enum parity
         working-directory: .
diff --git a/.github/workflows/python-lint.yml b/.github/workflows/python-lint.yml
index bc15ef7..ffeb429 100644
--- a/.github/workflows/python-lint.yml
+++ b/.github/workflows/python-lint.yml
@@ -17,10 +17,10 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.11
diff --git a/.github/workflows/python-test.yml b/.github/workflows/python-test.yml
index 457fca5..003e48f 100644
--- a/.github/workflows/python-test.yml
+++ b/.github/workflows/python-test.yml
@@ -30,10 +30,10 @@ jobs:
     name: sdist workspace manifest is loadable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -59,14 +59,14 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enum parity
         working-directory: .
         run: python3 scripts/check_enum_parity.py
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
@@ -92,7 +92,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.11'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v7
         with:
           file: ./packages/python/coverage.xml
           fail_ci_if_error: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a3dbcb5..78a6d72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       rust-release-created: ${{ steps.release.outputs['packages/rust/core--release_created'] }}
       rust-tag: ${{ steps.release.outputs['packages/rust/core--tag_name'] }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         id: release
         with:
           config-file: release-please-config.json
@@ -33,7 +33,7 @@ jobs:
     if: ${{ needs.release-please.outputs.rust-release-created }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
 
@@ -73,7 +73,7 @@ jobs:
           - os: windows-latest
             target: x86_64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: PyO3/maturin-action@v1
         with:
@@ -83,7 +83,7 @@ jobs:
           args: --release --out dist --find-interpreter
           sccache: true
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: wheels-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux || 'auto' }}
           path: packages/python/dist
@@ -93,7 +93,7 @@ jobs:
     if: ${{ needs.release-please.outputs.python-release-created }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: PyO3/maturin-action@v1
         with:
@@ -101,7 +101,7 @@ jobs:
           command: sdist
           args: --out dist
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: wheels-sdist
           path: packages/python/dist
@@ -110,7 +110,7 @@ jobs:
     needs: [build-python-wheels, build-python-sdist]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           pattern: wheels-*
           merge-multiple: true
@@ -134,7 +134,7 @@ jobs:
       run:
         working-directory: packages/javascript
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -151,7 +151,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: wasm-pack build packages/rust/wasm --target web --out-dir ../../javascript/src/wasm-core
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '25'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml
index ea7ab9d..721d36a 100644
--- a/.github/workflows/rust-test.yml
+++ b/.github/workflows/rust-test.yml
@@ -23,7 +23,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Enum parity
         working-directory: .