diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3e2b6fc2..b6abf672 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -77,7 +77,7 @@ jobs:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           cache: "pnpm"
@@ -86,7 +86,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true
@@ -214,7 +214,7 @@ jobs:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           cache: "pnpm"
@@ -282,7 +282,7 @@ jobs:
       # pnpm-lock.yaml in the workspace, so it hard-fails with "Dependencies
       # lock file is not found" before any test runs.
       - name: Setup Node.js only
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "26"
 
@@ -405,7 +405,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true
@@ -413,7 +413,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.runtime == 'node'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.version }}
 
@@ -492,7 +492,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true
@@ -604,7 +604,7 @@ jobs:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           registry-url: "https://registry.npmjs.org"
@@ -734,7 +734,7 @@ jobs:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           cache: "pnpm"
@@ -745,7 +745,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true
@@ -805,7 +805,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true
@@ -881,7 +881,7 @@ jobs:
       # publishes prebuilt directories from an artifact and never checks
       # out the repo, so there is no lockfile for the cache to key on.
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index adaae99e..c50ad1ea 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Setup Go
         if: matrix.language == 'go'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache-dependency-path: go.sum
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index c888edeb..747f6a07 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -18,6 +18,6 @@ jobs:
           fetch-depth: 1
 
       - name: Label PR
-        uses: actions/labeler@v6
+        uses: actions/labeler@v7
         with:
           configuration-path: .github/pr-labeler.yml
diff --git a/.github/workflows/publish-ajan.yml b/.github/workflows/publish-ajan.yml
index 40d04cf7..77173990 100644
--- a/.github/workflows/publish-ajan.yml
+++ b/.github/workflows/publish-ajan.yml
@@ -76,7 +76,7 @@ jobs:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           cache: "pnpm"
@@ -87,7 +87,7 @@ jobs:
         run: pnpm install --no-frozen-lockfile
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true
@@ -134,7 +134,7 @@ jobs:
           version: 10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "latest"
           registry-url: "https://registry.npmjs.org"
@@ -147,7 +147,7 @@ jobs:
         run: pnpm install --no-frozen-lockfile
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: "stable"
           cache: true