diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 23b4b78..6963df8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,14 +56,14 @@ jobs:
             echo "apt-get update returned nonzero — proceeding with whatever indexes did fetch"
           apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
             build-essential git pkg-config
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
           go-version: "1.25"
           check-latest: true
           cache: true
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
           version: v2.12.1
           args: --timeout=5m
@@ -97,8 +97,8 @@ jobs:
             echo "apt-get update returned nonzero — proceeding with whatever indexes did fetch"
           apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
             build-essential git pkg-config
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go }}
           check-latest: true
@@ -125,7 +125,7 @@ jobs:
             exit 1
           }
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-go${{ matrix.go }}
           path: coverage.out
@@ -156,8 +156,8 @@ jobs:
             echo "apt-get update returned nonzero — proceeding with whatever indexes did fetch"
           apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
             build-essential git pkg-config
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
           go-version: "1.25"
           check-latest: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 102f8d5..d27f535 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,7 @@ jobs:
             echo "apt-get update returned nonzero — proceeding with whatever indexes did fetch"
           apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
             build-essential file git pkg-config
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       # CodeQL's tooling (and the Autobuild step) runs git internally;
       # the checkout's directory ownership doesn't match the runner-user
       # inside this container, so git refuses to operate on it
@@ -52,22 +52,22 @@ jobs:
       # https://git-scm.com/docs/git-config#Documentation/git-config.txt-safedirectory
       - name: Trust the checkout directory for git
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: "1.25"
           check-latest: true
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: go
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: /language:go
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 723e354..b753629 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -46,7 +46,7 @@ jobs:
     env:
       GEOSERVER_VERSION: ${{ matrix.geoserver }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       # Cache the manifest-driven testdata fixtures across runs. The cache
       # key is bound to the manifest hash, so any manifest change (new
@@ -58,7 +58,7 @@ jobs:
       # integration tests walk `./testdata/` recursively and would
       # otherwise pick up the fetched fixtures and break.
       - name: Cache fetched testdata
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: testdata-fetched
           key: testdata-${{ hashFiles('testdata/manifest.sha256') }}
@@ -74,10 +74,10 @@ jobs:
       # transient Ubuntu-mirror outage fails the whole job. With cache,
       # apt only re-runs on Dockerfile changes — far less surface for
       # mirror flakes.
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Build dev image (with GHA cache)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
@@ -88,7 +88,7 @@ jobs:
           cache-to: type=gha,scope=dev-image,mode=max
 
       - name: Build GeoServer test image (with GHA cache)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
@@ -121,7 +121,7 @@ jobs:
 
       - name: Upload compose logs artifact (on failure)
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: compose-logs-${{ matrix.geoserver }}
           path: ./compose-logs/compose-logs-${{ matrix.geoserver }}.txt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ddd9216..a077eac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
     name: Release ${{ github.ref_name }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0  # full history so `git describe` resolves
 
@@ -53,13 +53,13 @@ jobs:
       # ---------- Docker image (multi-arch) -------------------------------
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -71,7 +71,7 @@ jobs:
 
       - name: Build + push image (linux/amd64,linux/arm64)
         id: build_image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           target: runtime
@@ -114,7 +114,7 @@ jobs:
       # magnitude faster.
 
       - name: Build amd64 runtime image into local Docker daemon
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
@@ -189,7 +189,7 @@ jobs:
           cat release-notes.md
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           name: ${{ env.VERSION }}
           tag_name: ${{ env.VERSION }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index c0250d1..430ce20 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -39,13 +39,13 @@ jobs:
     name: Trivy (runtime image)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build runtime image (with GHA cache)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
@@ -69,7 +69,7 @@ jobs:
 
       - name: Upload SARIF (image)
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-image.sarif
           # Single shared category for both Trivy uploads. With distinct
@@ -87,7 +87,7 @@ jobs:
     name: Trivy (repository fs)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Trivy filesystem scan
         uses: aquasecurity/trivy-action@v0.36.0
@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload SARIF (fs)
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-fs.sarif
           # See the trivy-image step's category comment for rationale.