diff --git a/.github/workflows/backend-lint-test.yml b/.github/workflows/backend-lint-test.yml
index bf7dc07679..ae764cec37 100644
--- a/.github/workflows/backend-lint-test.yml
+++ b/.github/workflows/backend-lint-test.yml
@@ -9,13 +9,13 @@ jobs:
     name: Lint Backend
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'backend/go.mod'
           cache-dependency-path: 'backend/go.sum'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
           version: v2.10
           working-directory: backend
@@ -25,7 +25,7 @@ jobs:
     name: Test Backend
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'backend/go.mod'
@@ -33,7 +33,7 @@ jobs:
       - name: Setup Docker Builder
         uses: useblacksmith/setup-docker-builder@v1
       - name: Install Task
-        uses: arduino/setup-task@v1
+        uses: arduino/setup-task@v2
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index c0ea059898..14f96c2d30 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -33,13 +33,13 @@ jobs:
           git checkout -b "changelog/${{ steps.tag.outputs.name }}"
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 
       - name: Cache Claude Code
         id: cache-claude
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.npm
           key: claude-code-${{ runner.os }}
@@ -98,7 +98,7 @@ jobs:
       # the PR mergeable — mirrors enterprise-ci-skip.yml.
       - name: Post Enterprise CI skip status
         if: ${{ steps.changelog_pr.outputs.created == 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ github.token }}
           script: |
diff --git a/.github/workflows/enterprise-ci-skip.yml b/.github/workflows/enterprise-ci-skip.yml
index 640f805cb3..2cd943e330 100644
--- a/.github/workflows/enterprise-ci-skip.yml
+++ b/.github/workflows/enterprise-ci-skip.yml
@@ -23,17 +23,17 @@ jobs:
   skip-enterprise-ci:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ vars.RP_AWS_CRED_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.RP_AWS_CRED_ACCOUNT_ID }}:role/${{ vars.RP_AWS_CRED_BASE_ROLE_NAME }}${{ github.event.repository.name }}
-      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
+      - uses: aws-actions/aws-secretsmanager-get-secrets@v3
         with:
           secret-ids: |
             ,sdlc/prod/github/actions_bot_token
           parse-json-secrets: true
       - name: Set success enterprise CI status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ env.ACTIONS_BOT_TOKEN }}
           script: |
diff --git a/.github/workflows/fork-pr-dispatch.yml b/.github/workflows/fork-pr-dispatch.yml
index 777878e11a..c838afac4f 100644
--- a/.github/workflows/fork-pr-dispatch.yml
+++ b/.github/workflows/fork-pr-dispatch.yml
@@ -16,11 +16,11 @@ jobs:
       github.event.workflow_run.head_repository.fork == true
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ vars.RP_AWS_CRED_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.RP_AWS_CRED_ACCOUNT_ID }}:role/${{ vars.RP_AWS_CRED_BASE_ROLE_NAME }}${{ github.event.repository.name }}
-      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
+      - uses: aws-actions/aws-secretsmanager-get-secrets@v3
         with:
           secret-ids: |
             ,sdlc/prod/github/actions_bot_token
@@ -31,7 +31,7 @@ jobs:
           HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
           HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
           HEAD_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const payload = {
@@ -43,7 +43,7 @@ jobs:
             core.setOutput('json', JSON.stringify(payload));
             core.setOutput('sha', process.env.HEAD_SHA);
       - name: Repository dispatch for fork PR
-        uses: peter-evans/repository-dispatch@caebe2a7c967e9f927ff8780fea8e16e50b5ce40
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ env.ACTIONS_BOT_TOKEN }}
           repository: redpanda-data/console-enterprise
@@ -52,7 +52,7 @@ jobs:
       - name: Set pending enterprise CI status
         env:
           HEAD_SHA: ${{ steps.payload.outputs.sha }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ env.ACTIONS_BOT_TOKEN }}
           script: |
diff --git a/.github/workflows/frontend-react-doctor.yml b/.github/workflows/frontend-react-doctor.yml
index 50c6d0ffd0..4e1c2e631e 100644
--- a/.github/workflows/frontend-react-doctor.yml
+++ b/.github/workflows/frontend-react-doctor.yml
@@ -21,11 +21,11 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.bun/install/cache
           key: ${{ runner.os }}-bun-cache-${{ env.BUN_CACHE_SALT }}-${{ hashFiles('frontend/bun.lock') }}
diff --git a/.github/workflows/frontend-verify.yml b/.github/workflows/frontend-verify.yml
index 3417325aa5..0d424b2500 100644
--- a/.github/workflows/frontend-verify.yml
+++ b/.github/workflows/frontend-verify.yml
@@ -14,7 +14,7 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Install dependencies
@@ -46,7 +46,7 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Install dependencies
@@ -62,13 +62,13 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Restore Rspack build cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: frontend/node_modules/.cache
           key: ${{ runner.os }}-rspack-${{ env.BUN_CACHE_SALT }}-${{ hashFiles('frontend/bun.lock', 'frontend/package.json', 'frontend/src/**', 'frontend/rsbuild.config.ts') }}
@@ -82,7 +82,7 @@ jobs:
           REACT_APP_DEV_HINT=true
           bun run build
       - name: Upload frontend build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: frontend-build
           path: frontend/build
@@ -96,14 +96,14 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run unit tests
         run: bun run test:unit
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: unit-test-results
@@ -122,14 +122,14 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Run integration tests
         run: bun run test:integration -- --shard=${{ matrix.shard }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: integration-test-results-${{ matrix.shard }}
diff --git a/.github/workflows/proto-generate.yml b/.github/workflows/proto-generate.yml
index b5cf132be3..5db6ea3aeb 100644
--- a/.github/workflows/proto-generate.yml
+++ b/.github/workflows/proto-generate.yml
@@ -22,14 +22,14 @@ jobs:
     env:
       CI: "true"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ vars.RP_AWS_CRED_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.RP_AWS_CRED_ACCOUNT_ID }}:role/${{ vars.RP_AWS_CRED_BASE_ROLE_NAME }}${{ github.event.repository.name }}
 
-      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
+      - uses: aws-actions/aws-secretsmanager-get-secrets@v3
         with:
           secret-ids: |
             ,sdlc/prod/github/buf_token
@@ -41,13 +41,13 @@ jobs:
           cache-dependency-path: 'backend/go.sum'
 
       - name: Install Task
-        uses: arduino/setup-task@v1
+        uses: arduino/setup-task@v2
         with:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Cache proto tools
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: build
           key: proto-tools-${{ runner.os }}-go${{ hashFiles('backend/go.mod') }}-${{ hashFiles('taskfiles/proto.yaml') }}
diff --git a/.github/workflows/repository-dispatch.yml b/.github/workflows/repository-dispatch.yml
index 5d5b5eed98..816da660cf 100644
--- a/.github/workflows/repository-dispatch.yml
+++ b/.github/workflows/repository-dispatch.yml
@@ -38,17 +38,17 @@ jobs:
     if: "!failure() && !cancelled()"
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ vars.RP_AWS_CRED_REGION }}
           role-to-assume: arn:aws:iam::${{ secrets.RP_AWS_CRED_ACCOUNT_ID }}:role/${{ vars.RP_AWS_CRED_BASE_ROLE_NAME }}${{ github.event.repository.name }}
-      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
+      - uses: aws-actions/aws-secretsmanager-get-secrets@v3
         with:
           secret-ids: |
             ,sdlc/prod/github/actions_bot_token
           parse-json-secrets: true
       - name: Repository Dispatch on Release
-        uses: peter-evans/repository-dispatch@caebe2a7c967e9f927ff8780fea8e16e50b5ce40
+        uses: peter-evans/repository-dispatch@v4
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}
         with:
           token: ${{ env.ACTIONS_BOT_TOKEN }}
@@ -56,7 +56,7 @@ jobs:
           event-type: release
           client-payload: '{"branch": "master", "commit_sha": "${{ github.sha }}", "tag_name": "${{ github.event.release.tag_name }}"}'
       - name: Repository Dispatch on push
-        uses: peter-evans/repository-dispatch@caebe2a7c967e9f927ff8780fea8e16e50b5ce40
+        uses: peter-evans/repository-dispatch@v4
         if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         with:
           token: ${{ env.ACTIONS_BOT_TOKEN }}
@@ -65,7 +65,7 @@ jobs:
           client-payload: '{"branch": "${{ github.ref_name }}", "commit_sha": "${{ github.sha }}"}'
       - name: Set pending enterprise CI status
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ env.ACTIONS_BOT_TOKEN }}
           script: |