diff --git a/.github/workflows/_atlas-migrations-reusable.yml b/.github/workflows/_atlas-migrations-reusable.yml
index fa06e4e..4cd1f67 100644
--- a/.github/workflows/_atlas-migrations-reusable.yml
+++ b/.github/workflows/_atlas-migrations-reusable.yml
@@ -140,7 +140,7 @@ jobs:
           goprivate: ${{ inputs.goprivate }}
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ inputs.go_version }}
 
@@ -178,7 +178,7 @@ jobs:
           curl -sSf https://atlasgo.sh | sh -s -- --version ${{ inputs.atlas_version }}
 
       - name: Cache Go modules
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
diff --git a/.github/workflows/_checks-expo.yaml b/.github/workflows/_checks-expo.yaml
index 397e949..5d02344 100644
--- a/.github/workflows/_checks-expo.yaml
+++ b/.github/workflows/_checks-expo.yaml
@@ -192,7 +192,7 @@ jobs:
 
       - name: Cache pnpm store
         if: inputs.cache_bucket != '' && steps.pm.outputs.pm_name == 'pnpm' && steps.pnpm-cache.outputs.STORE_PATH != '' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -210,7 +210,7 @@ jobs:
 
       - name: Cache Bun dependencies
         if: inputs.cache_bucket != '' && steps.pm.outputs.pm_name == 'bun' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -258,7 +258,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: ${{ inputs.enable_tests && inputs.enable_coverage && inputs.upload_coverage }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.codecov_token }}
           flags: ${{ inputs.codecov_flags }}
diff --git a/.github/workflows/_checks-golang.yaml b/.github/workflows/_checks-golang.yaml
index 29d08f7..a19ba5c 100644
--- a/.github/workflows/_checks-golang.yaml
+++ b/.github/workflows/_checks-golang.yaml
@@ -196,7 +196,7 @@ jobs:
   post-coverage-comment:
     needs: checks
     if: inputs.enable_coverage && inputs.post_pr_comment && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && always() && needs.checks.outputs.coverage_status != ''
-    uses: zondax/_workflows/.github/workflows/_post-pr-comment-reusable.yml@v5
+    uses: zondax/_workflows/.github/workflows/_post-pr-comment-reusable.yml@v11
     secrets: inherit
     with:
       issue_number: ${{ github.event.number }}
diff --git a/.github/workflows/_checks-playwright.yaml b/.github/workflows/_checks-playwright.yaml
index d5be07c..c3e81a8 100644
--- a/.github/workflows/_checks-playwright.yaml
+++ b/.github/workflows/_checks-playwright.yaml
@@ -289,7 +289,7 @@ jobs:
 
       - name: Cache Cargo registry
         if: inputs.use_rust_cache && inputs.cache_bucket != '' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -310,7 +310,7 @@ jobs:
 
       - name: Cache Next.js build
         if: inputs.enable_nextjs_cache && inputs.cache_bucket != '' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -369,7 +369,7 @@ jobs:
 
       - name: Cache pnpm store
         if: inputs.cache_bucket != '' && steps.pm.outputs.pm_name == 'pnpm' && steps.pnpm-cache.outputs.STORE_PATH != '' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -387,7 +387,7 @@ jobs:
 
       - name: Cache Bun dependencies
         if: inputs.cache_bucket != '' && steps.pm.outputs.pm_name == 'bun' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
diff --git a/.github/workflows/_checks-rs.yaml b/.github/workflows/_checks-rs.yaml
index 9907871..b06f7c4 100644
--- a/.github/workflows/_checks-rs.yaml
+++ b/.github/workflows/_checks-rs.yaml
@@ -299,7 +299,7 @@ jobs:
 
       - name: Cache Cargo registry
         if: inputs.cache_bucket != '' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -617,7 +617,7 @@ jobs:
 
       - name: Cache coverage baseline
         if: ${{ github.event_name == 'push' && inputs.enable_coverage && (inputs.coverage_regression_tolerance > 0 || inputs.coverage_diff_threshold > 0) }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           key: coverage-baseline-${{ github.ref_name }}-rs-${{ inputs.coverage_artifact_suffix }}-${{ github.sha }}
           path: coverage-baseline/
@@ -625,7 +625,7 @@ jobs:
       - name: Restore coverage baseline
         if: ${{ github.event_name == 'pull_request' && inputs.enable_coverage && (inputs.coverage_regression_tolerance > 0 || inputs.coverage_diff_threshold > 0) }}
         id: baseline-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           key: coverage-baseline-${{ github.base_ref }}-rs-${{ inputs.coverage_artifact_suffix }}-no-exact-match
           restore-keys: |
@@ -812,7 +812,7 @@ jobs:
   post-coverage-comment:
     needs: checks-rust
     if: inputs.enable_coverage && inputs.post_pr_comment && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && always() && needs.checks-rust.outputs.coverage_status != ''
-    uses: zondax/_workflows/.github/workflows/_post-pr-comment-reusable.yml@v5
+    uses: zondax/_workflows/.github/workflows/_post-pr-comment-reusable.yml@v11
     secrets: inherit
     with:
       issue_number: ${{ github.event.number }}
diff --git a/.github/workflows/_checks-ts.yaml b/.github/workflows/_checks-ts.yaml
index 95a4587..8b34198 100644
--- a/.github/workflows/_checks-ts.yaml
+++ b/.github/workflows/_checks-ts.yaml
@@ -288,7 +288,7 @@ jobs:
 
       - name: Cache pnpm store
         if: inputs.cache_pnpm && inputs.cache_bucket != '' && steps.pm.outputs.pm_name == 'pnpm' && steps.pnpm-cache.outputs.STORE_PATH != '' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -306,7 +306,7 @@ jobs:
 
       - name: Cache Bun dependencies
         if: inputs.cache_bucket != '' && steps.pm.outputs.pm_name == 'bun' && steps.cache-control.outputs.enabled != 'false'
-        uses: runs-on/cache@v4
+        uses: runs-on/cache@v5
         env:
           RUNS_ON_S3_BUCKET_CACHE: ${{ inputs.cache_bucket }}
           RUNS_ON_S3_FORCE_PATH_STYLE: "true"
@@ -390,7 +390,7 @@ jobs:
 
       - name: Cache coverage baseline
         if: ${{ github.event_name == 'push' && inputs.enable_tests && inputs.enable_coverage && (inputs.coverage_regression_tolerance > 0 || inputs.coverage_diff_threshold > 0) }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           key: coverage-baseline-${{ github.ref_name }}-ts-${{ github.sha }}
           path: coverage-baseline/
@@ -398,7 +398,7 @@ jobs:
       - name: Restore coverage baseline
         if: ${{ github.event_name == 'pull_request' && inputs.enable_tests && inputs.enable_coverage && (inputs.coverage_regression_tolerance > 0 || inputs.coverage_diff_threshold > 0) }}
         id: baseline-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           key: coverage-baseline-${{ github.base_ref }}-ts-no-exact-match
           restore-keys: |
@@ -711,7 +711,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: ${{ inputs.enable_tests && inputs.enable_coverage && inputs.upload_coverage }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.codecov_token }}
           flags: ${{ inputs.codecov_flags }}
@@ -725,7 +725,7 @@ jobs:
       (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') &&
       always() &&
       needs.checks-ts.outputs.coverage_lines != ''
-    uses: zondax/_workflows/.github/workflows/_post-pr-comment-reusable.yml@v5
+    uses: zondax/_workflows/.github/workflows/_post-pr-comment-reusable.yml@v11
     secrets: inherit
     with:
       issue_number: ${{ github.event.number }}
diff --git a/.github/workflows/_cloud-run-build-docker.yml b/.github/workflows/_cloud-run-build-docker.yml
index 651ae93..51d08f8 100644
--- a/.github/workflows/_cloud-run-build-docker.yml
+++ b/.github/workflows/_cloud-run-build-docker.yml
@@ -76,7 +76,7 @@ jobs:
       - name: Configure Docker to use gcloud (for Artifact Registry)
         run: gcloud auth configure-docker ${{ vars.PULUMI_GAR_LOCATION }}-docker.pkg.dev
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           driver: docker-container
       - name: Build Docker image
diff --git a/.github/workflows/_cloud-run-canary-deploy.yml b/.github/workflows/_cloud-run-canary-deploy.yml
index 5e24541..13943f0 100644
--- a/.github/workflows/_cloud-run-canary-deploy.yml
+++ b/.github/workflows/_cloud-run-canary-deploy.yml
@@ -66,7 +66,7 @@ jobs:
           project_id: ${{ vars.PULUMI_GCP_PROJECT_ID }}
 
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: 1.24
 
diff --git a/.github/workflows/_cloud-run-cleanup.yml b/.github/workflows/_cloud-run-cleanup.yml
index aa6685a..31989ca 100644
--- a/.github/workflows/_cloud-run-cleanup.yml
+++ b/.github/workflows/_cloud-run-cleanup.yml
@@ -30,7 +30,7 @@ jobs:
           setup_gcloud: true
         
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: 1.24
         
diff --git a/.github/workflows/_cloud-run-deploy-keep-revisions.yml b/.github/workflows/_cloud-run-deploy-keep-revisions.yml
index b87a839..ab9bb74 100644
--- a/.github/workflows/_cloud-run-deploy-keep-revisions.yml
+++ b/.github/workflows/_cloud-run-deploy-keep-revisions.yml
@@ -73,7 +73,7 @@ jobs:
           log_jwt_info: true
         
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: 1.24
         
diff --git a/.github/workflows/_cloud-run-deploy.yml b/.github/workflows/_cloud-run-deploy.yml
index 422afad..28c9fa6 100644
--- a/.github/workflows/_cloud-run-deploy.yml
+++ b/.github/workflows/_cloud-run-deploy.yml
@@ -77,7 +77,7 @@ jobs:
           log_jwt_info: true
         
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: 1.24
         
diff --git a/.github/workflows/_ledger_lint.yml b/.github/workflows/_ledger_lint.yml
index 0b759f0..1e85ef0 100644
--- a/.github/workflows/_ledger_lint.yml
+++ b/.github/workflows/_ledger_lint.yml
@@ -41,7 +41,7 @@ jobs:
         run: bear -- make -j BOLOS_SDK="$NANOSP_SDK"
       - name: Setup python
         if: ${{ !inputs.use_latest_builder }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Lint and format 💅
diff --git a/.github/workflows/_ledger_main.yml b/.github/workflows/_ledger_main.yml
index 2172afa..8514735 100644
--- a/.github/workflows/_ledger_main.yml
+++ b/.github/workflows/_ledger_main.yml
@@ -112,7 +112,7 @@ jobs:
           targets: thumbv6m-none-eabi
       - name: Cache Rust dependencies
         if: ${{ inputs.has-rust }}
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ${{ needs.setup.outputs.cargo_home }}
@@ -151,7 +151,7 @@ jobs:
         with:
           submodules: recursive
       - name: Cache/restore Cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ./app/rust/.cargo
           key: ${{ runner.os }}-cargo-${{ runner.arch }}-${{ hashFiles('./Cargo.lock') }}
@@ -182,7 +182,7 @@ jobs:
         with:
           submodules: recursive
       - name: Cache/restore Cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ./app/rust/.cargo
           key: ${{ runner.os }}-cargo-${{ runner.arch }}-${{ hashFiles('./Cargo.lock') }}
@@ -234,13 +234,13 @@ jobs:
         with:
           toolchain: ${{ inputs.rust-version }}
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
       - name: Enable corepack (pnpm version is pinned in zxlib's dockerized_build.mk)
         run: corepack enable
       - name: Install Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
       - name: Build and run zemu tests
@@ -281,7 +281,7 @@ jobs:
           targets: thumbv6m-none-eabi
       - name: Cache Rust dependencies
         if: ${{ inputs.has-rust }}
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ${{ needs.setup.outputs.cargo_home }}
@@ -363,7 +363,7 @@ jobs:
           targets: thumbv6m-none-eabi
       - name: Cache Rust dependencies
         if: ${{ inputs.has-rust }}
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ${{ needs.setup.outputs.cargo_home }}
@@ -445,7 +445,7 @@ jobs:
           targets: thumbv6m-none-eabi
       - name: Cache Rust dependencies
         if: ${{ inputs.has-rust }}
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ${{ needs.setup.outputs.cargo_home }}
@@ -526,7 +526,7 @@ jobs:
           targets: thumbv6m-none-eabi
       - name: Cache Rust dependencies
         if: ${{ inputs.has-rust }}
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ${{ needs.setup.outputs.cargo_home }}
@@ -607,7 +607,7 @@ jobs:
           targets: thumbv6m-none-eabi
       - name: Cache Rust dependencies
         if: ${{ inputs.has-rust }}
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ${{ needs.setup.outputs.cargo_home }}
diff --git a/.github/workflows/_post-pr-comment-reusable.yml b/.github/workflows/_post-pr-comment-reusable.yml
index bb77b30..d2e19fe 100644
--- a/.github/workflows/_post-pr-comment-reusable.yml
+++ b/.github/workflows/_post-pr-comment-reusable.yml
@@ -44,7 +44,7 @@ jobs:
     runs-on: zondax-runners
     steps:
       - name: Post or update PR comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         with:
           issue-number: ${{ inputs.issue_number }}
           comment-id: ${{ inputs.comment_identifier }}
diff --git a/.github/workflows/_publish-docker-bake.yaml b/.github/workflows/_publish-docker-bake.yaml
index 2df0f0c..eb1ad62 100644
--- a/.github/workflows/_publish-docker-bake.yaml
+++ b/.github/workflows/_publish-docker-bake.yaml
@@ -199,7 +199,7 @@ jobs:
         run: gcloud auth configure-docker ${{ vars.PULUMI_GAR_LOCATION }}-docker.pkg.dev
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "22"
 
@@ -467,7 +467,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request'
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: |
diff --git a/.github/workflows/_publish-docker.yaml b/.github/workflows/_publish-docker.yaml
index 3503b7f..e93acaa 100644
--- a/.github/workflows/_publish-docker.yaml
+++ b/.github/workflows/_publish-docker.yaml
@@ -92,7 +92,7 @@ jobs:
           echo "GIT_BRANCH_GITHUB=$GIT_BRANCH_GITHUB"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
diff --git a/.github/workflows/_publish-npm.yaml b/.github/workflows/_publish-npm.yaml
index c94ae15..bf978f1 100644
--- a/.github/workflows/_publish-npm.yaml
+++ b/.github/workflows/_publish-npm.yaml
@@ -111,7 +111,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node_version }}
           registry-url: "https://registry.npmjs.org"