diff --git a/.github/workflows/ci-skill.yml b/.github/workflows/ci-skill.yml
index 33015345..35954220 100644
--- a/.github/workflows/ci-skill.yml
+++ b/.github/workflows/ci-skill.yml
@@ -38,13 +38,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: "pnpm"
diff --git a/.github/workflows/cli-skills-smoke.yml b/.github/workflows/cli-skills-smoke.yml
index fb8fbed0..0bea9086 100644
--- a/.github/workflows/cli-skills-smoke.yml
+++ b/.github/workflows/cli-skills-smoke.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install skill in a disposable home
         run: |
diff --git a/.github/workflows/longcot-bench.yml b/.github/workflows/longcot-bench.yml
index 2add6bfe..a7924356 100644
--- a/.github/workflows/longcot-bench.yml
+++ b/.github/workflows/longcot-bench.yml
@@ -96,17 +96,17 @@ jobs:
     timeout-minutes: 350
     steps:
       - name: Checkout prose
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout LongCoT
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: LongHorizonReasoning/longcot
           ref: ${{ inputs.longcot_ref }}
           path: longcot
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -129,7 +129,7 @@ jobs:
           pi --version || pi --help | head -1
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
@@ -253,7 +253,7 @@ jobs:
 
       - name: Upload responses artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: longcot-responses-${{ github.run_id }}
           path: longcot/responses/**
@@ -262,7 +262,7 @@ jobs:
 
       - name: Upload results artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: longcot-results-${{ github.run_id }}
           path: longcot/results/**
diff --git a/.github/workflows/longcot-rlmify.yml b/.github/workflows/longcot-rlmify.yml
index cb4b7540..94ec5dfe 100644
--- a/.github/workflows/longcot-rlmify.yml
+++ b/.github/workflows/longcot-rlmify.yml
@@ -86,17 +86,17 @@ jobs:
     timeout-minutes: 240
     steps:
       - name: Checkout prose
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout LongCoT
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: LongHorizonReasoning/longcot
           ref: ${{ inputs.longcot_ref }}
           path: longcot
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -139,7 +139,7 @@ jobs:
           rlmify --help | head -1
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
@@ -299,7 +299,7 @@ jobs:
 
       - name: Upload responses artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: longcot-rlmify-responses-${{ github.run_id }}
           path: longcot/responses/**
@@ -308,7 +308,7 @@ jobs:
 
       - name: Upload results artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: longcot-rlmify-results-${{ github.run_id }}
           path: longcot/results/**
@@ -317,7 +317,7 @@ jobs:
 
       - name: Upload rlmify logs artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: longcot-rlmify-logs-${{ github.run_id }}
           path: longcot/rlmify-logs/**
diff --git a/.github/workflows/openprose-smoke.yml b/.github/workflows/openprose-smoke.yml
index d3720be8..07668e7e 100644
--- a/.github/workflows/openprose-smoke.yml
+++ b/.github/workflows/openprose-smoke.yml
@@ -52,7 +52,7 @@ jobs:
       cases: ${{ steps.cases.outputs.cases }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -89,7 +89,7 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ matrix.case_id != '__none__' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -97,7 +97,7 @@ jobs:
 
       - name: Setup Node
         if: ${{ matrix.case_id != '__none__' }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -145,7 +145,7 @@ jobs:
 
       - name: Upload smoke artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: openprose-smoke-${{ matrix.case_id }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: openprose-smoke-results/**
diff --git a/.github/workflows/plugin-manifest.yml b/.github/workflows/plugin-manifest.yml
index 20b58226..7d642d33 100644
--- a/.github/workflows/plugin-manifest.yml
+++ b/.github/workflows/plugin-manifest.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 2
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate Claude plugin manifest
         run: |