diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b01e2f4..ab0699d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
           distribution: temurin
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.2.0
         with:
           cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}
 
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index 381a652..2cd7dfe 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -25,7 +25,7 @@ jobs:
           java-version: "21"
 
       - name: Submit dependency graph
-        uses: gradle/actions/dependency-submission@v6
+        uses: gradle/actions/dependency-submission@v6.2.0
         with:
           # Supply-chain enrichment feed for Dependabot, not a correctness gate
           # (build/test/security gates live in ci.yml). A platform-side rejection
diff --git a/.github/workflows/examples-ci.yml b/.github/workflows/examples-ci.yml
index 2ce186e..ab1edcb 100644
--- a/.github/workflows/examples-ci.yml
+++ b/.github/workflows/examples-ci.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
       - name: Build the local SDK dependency
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3fa49fe..caada3d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
           distribution: temurin
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.2.0
 
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
@@ -177,7 +177,7 @@ jobs:
           distribution: temurin
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@v6.2.0
 
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
diff --git a/.github/workflows/sdk-ts-ci.yml b/.github/workflows/sdk-ts-ci.yml
index 57e6f8e..8a1c1e7 100644
--- a/.github/workflows/sdk-ts-ci.yml
+++ b/.github/workflows/sdk-ts-ci.yml
@@ -23,7 +23,7 @@ jobs:
         working-directory: sdk/typescript
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 733c228..d3f018d 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Mark stale issues and PRs
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/web-ci.yml b/.github/workflows/web-ci.yml
index a0d51c0..996f937 100644
--- a/.github/workflows/web-ci.yml
+++ b/.github/workflows/web-ci.yml
@@ -24,7 +24,7 @@ jobs:
         working-directory: web
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm