diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index 7f2aa1ad..4baf1d85 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -25,8 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .tool-versions
 
@@ -60,9 +60,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .tool-versions
           cache: pnpm
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 091479c7..92022088 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -21,9 +21,9 @@ jobs:
         node: [22, 24]
     name: Node ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c52576a8..cd13c4b2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -55,10 +55,10 @@ jobs:
     # 15 s - it is slow to resolve a fresh version some days) sit on top of the build.
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .tool-versions
           registry-url: https://registry.npmjs.org
@@ -76,7 +76,7 @@ jobs:
       # the occt package names them with their SHA-256 and where they are published, and the fetch
       # verifies what is present and downloads what is not. Cached on the manifest's hash so a
       # rebuild, and only a rebuild, downloads again.
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           key: occt-kernels-${{ hashFiles('packages/dev/occt/kernels.json') }}
           path: packages/dev/occt/bitbybit-dev-occt*/*.wasm
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index be332362..830e1afe 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -29,12 +29,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # pnpm's version comes from the packageManager field; Node's from .tool-versions, the one pin
       # mise and asdf read on a developer's machine as well.
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .tool-versions
           cache: pnpm
@@ -45,7 +45,7 @@ jobs:
       # the occt package names them with their SHA-256 and where they are published, and the fetch
       # verifies what is present and downloads what is not. Cached on the manifest's hash so a
       # rebuild, and only a rebuild, downloads again.
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           key: occt-kernels-${{ hashFiles('packages/dev/occt/kernels.json') }}
           path: packages/dev/occt/bitbybit-dev-occt*/*.wasm
@@ -134,8 +134,8 @@ jobs:
       run:
         working-directory: docs
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .tool-versions
           cache: npm