diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml
index 6cd0cf76..5746b88b 100644
--- a/.github/workflows/release-docs.yml
+++ b/.github/workflows/release-docs.yml
@@ -31,10 +31,14 @@ jobs:
         run: npm run build
 
       - name: Deploy to Cloudflare
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # wrangler-action v4 defaults to the Wrangler 4 CLI, a separate
+          # migration. Pinned so this change is only the runtime move.
+          # Unpinning is tracked in #331.
+          wranglerVersion: "3"
           workingDirectory: docs
           command: deploy
 
diff --git a/.github/workflows/release-helm.yml b/.github/workflows/release-helm.yml
index a5f54ae6..9639218e 100644
--- a/.github/workflows/release-helm.yml
+++ b/.github/workflows/release-helm.yml
@@ -32,7 +32,7 @@ jobs:
           fi
 
       - name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
 
       - name: Update chart version
         run: |
@@ -84,10 +84,17 @@ jobs:
           cp chart-pkg/index.yaml deploy/
 
       - name: Deploy index.yaml to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # website/ and docs/ pin the Wrangler CLI in their package-lock.json
+          # and the action picks that up; this job has no npm project to hold
+          # one, so it is the single site that needs the version stated. Exact,
+          # not a bare major: "3" is a range the action resolves to the newest
+          # 3.x at deploy time, which is the drift this pin exists to stop.
+          # Tracked with the other two in #331.
+          wranglerVersion: "3.114.17"
           command: pages deploy deploy --project-name traceway-charts --commit-dirty=true
 
       - name: Summary
diff --git a/.github/workflows/release-traceway.yml b/.github/workflows/release-traceway.yml
index d586175b..810ab957 100644
--- a/.github/workflows/release-traceway.yml
+++ b/.github/workflows/release-traceway.yml
@@ -196,18 +196,27 @@ jobs:
   build-docker:
     runs-on: ubuntu-latest
     needs: release
+    env:
+      # build-push-action v6+ generates a build summary and uploads a build
+      # record artifact per build. The summary is worth keeping -- all five
+      # builds below write cache-to: type=gha,mode=max, and it is the only
+      # place per-build cache-hit ratios show up without re-running a release.
+      # The records inherit the repo-wide artifact retention by default, so
+      # five of them accumulate per release; a week is long enough to debug
+      # the release that produced them.
+      DOCKER_BUILD_RECORD_RETENTION_DAYS: 7
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -215,7 +224,7 @@ jobs:
 
       - name: Build and push full image
         id: docker_build_full
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
@@ -228,7 +237,7 @@ jobs:
 
       - name: Build and push minimal image
         id: docker_build_minimal
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.minimal
@@ -241,7 +250,7 @@ jobs:
 
       - name: Build and push SQLite image
         id: docker_build_sqlite
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.sqlite
@@ -258,7 +267,7 @@ jobs:
       # impractically slow. arm64 users build Dockerfile.duckdb natively.
       - name: Build and push DuckDB image
         id: docker_build_duckdb
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.duckdb
@@ -275,7 +284,7 @@ jobs:
       # synthetic checks.
       - name: Build and push Browser image
         id: docker_build_browser
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile.browser
diff --git a/.github/workflows/release-website.yml b/.github/workflows/release-website.yml
index 6c2c1bda..1af9f270 100644
--- a/.github/workflows/release-website.yml
+++ b/.github/workflows/release-website.yml
@@ -31,10 +31,15 @@ jobs:
         run: npm run build
 
       - name: Deploy to Cloudflare
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # wrangler-action v4 defaults to the Wrangler 4 CLI, a separate
+          # migration on a production deploy path. Pinned so this change is
+          # only the runtime move.
+          # Unpinning is tracked in #331.
+          wranglerVersion: "3"
           workingDirectory: website
           command: deploy