diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 005bcff..2d06734 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
     env:
       DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select newest available Xcode
         run: |
@@ -54,7 +54,7 @@ jobs:
 
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: dist/coverage/
@@ -66,7 +66,7 @@ jobs:
     env:
       DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select newest available Xcode
         run: |
@@ -98,7 +98,7 @@ jobs:
 
       - name: Upload UI test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ui-test-results
           path: TestResults.xcresult
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 158d7e9..132f459 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
       NOTARY_PROFILE: capsule-notary
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Verify tag matches app version
         if: startsWith(github.ref, 'refs/tags/')
@@ -57,7 +57,7 @@ jobs:
       # ── Signed path ──────────────────────────────────────────────────────────
       - name: Import Developer ID certificate
         if: steps.signing.outputs.enabled == 'true'
-        uses: apple-actions/import-codesign-certs@v3
+        uses: apple-actions/import-codesign-certs@v7
         with:
           p12-file-base64: ${{ secrets.DEVELOPER_ID_CERT_P12_BASE64 }}
           p12-password: ${{ secrets.DEVELOPER_ID_CERT_PASSWORD }}
@@ -99,7 +99,7 @@ jobs:
       # ── Publish ──────────────────────────────────────────────────────────────
       - name: Upload build artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: capsule-release
           path: |
@@ -110,7 +110,7 @@ jobs:
 
       - name: Publish GitHub Release
         if: steps.signing.outputs.enabled == 'true' && startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             dist/Capsule-*.dmg