diff --git a/.github/workflows/android-applinks-verify.yml b/.github/workflows/android-applinks-verify.yml
index 04ed1a1..30d0f4e 100644
--- a/.github/workflows/android-applinks-verify.yml
+++ b/.github/workflows/android-applinks-verify.yml
@@ -28,7 +28,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Verify assetlinks.json
         env:
@@ -51,7 +51,7 @@ jobs:
       # new one when none exists.
       - name: Alert on failure (scheduled run)
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const title = "⚠️ assetlinks.json verification failed (scheduled check)";
diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
index 99aa717..7f8d261 100644
--- a/.github/workflows/android-ci.yml
+++ b/.github/workflows/android-ci.yml
@@ -18,10 +18,10 @@ jobs:
   dependency-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -41,7 +41,7 @@ jobs:
       # fetch the incremental delta. Keyed by week so the cache still refreshes
       # regularly rather than growing stale indefinitely.
       - name: Cache OWASP dependency-check database
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: android/dependency-check-data
           key: dependency-check-data-${{ steps.date.outputs.week }}
@@ -74,10 +74,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -218,7 +218,7 @@ jobs:
 
       - name: Upload R8 mapping file
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-r8-mapping
           path: android/app/build/outputs/mapping/release/mapping.txt
@@ -241,7 +241,7 @@ jobs:
 
       - name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-unit-test-reports
           path: android/app/build/reports/tests/testDebugUnitTest
@@ -249,7 +249,7 @@ jobs:
 
       - name: Upload code coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-coverage-report
           path: android/app/build/reports/jacoco/jacocoTestReport
@@ -257,7 +257,7 @@ jobs:
 
       - name: Upload Paparazzi diff report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: paparazzi-diff-report
           path: android/app/build/paparazzi/failures
@@ -265,7 +265,7 @@ jobs:
 
       - name: Upload lint report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-lint-report
           path: android/app/build/reports/lint-results-debug.html
@@ -286,10 +286,10 @@ jobs:
   instrumented-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -328,7 +328,7 @@ jobs:
 
       - name: Upload instrumented test reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-instrumented-test-reports
           path: android/app/build/reports/androidTests/connected
@@ -345,10 +345,10 @@ jobs:
   accessibility-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -381,7 +381,7 @@ jobs:
 
       - name: Upload accessibility scan report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-accessibility-scan-report
           path: android/app/build/reports/androidTests/connected
@@ -395,10 +395,10 @@ jobs:
   startup-benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -463,7 +463,7 @@ jobs:
 
       - name: Upload benchmark report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-startup-benchmark-report
           path: android/app/build/outputs/androidTest-results/connected
diff --git a/.github/workflows/android-dependency-check.yml b/.github/workflows/android-dependency-check.yml
index ab2771f..0aa59fe 100644
--- a/.github/workflows/android-dependency-check.yml
+++ b/.github/workflows/android-dependency-check.yml
@@ -44,10 +44,10 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -67,7 +67,7 @@ jobs:
       # fetch the incremental delta. Keyed by week so the cache still refreshes
       # regularly rather than growing stale indefinitely.
       - name: Cache OWASP dependency-check database
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: android/dependency-check-data
           key: dependency-check-data-${{ steps.date.outputs.week }}
@@ -101,7 +101,7 @@ jobs:
 
       - name: Alert on failure (scheduled run)
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.issues.create({
diff --git a/.github/workflows/android-firebase-distribution.yml b/.github/workflows/android-firebase-distribution.yml
index 169cb9a..393c9df 100644
--- a/.github/workflows/android-firebase-distribution.yml
+++ b/.github/workflows/android-firebase-distribution.yml
@@ -74,7 +74,7 @@ jobs:
       tester_groups: ${{ steps.firebase.outputs.tester_groups }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + tags: release notes are generated from commits since
           # the previous vX.Y.Z tag.
@@ -123,7 +123,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -181,7 +181,7 @@ jobs:
       # the Firebase upload fails or for manual sideloading in emergencies.
       - name: Upload APK artifact
         if: steps.options.outputs.dry_run != 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: beta-apk-${{ steps.options.outputs.build_type }}-${{ github.sha }}
           path: android/build/fastlane/firebase_beta/*.apk
diff --git a/.github/workflows/android-play-store-release.yml b/.github/workflows/android-play-store-release.yml
index 594739d..146a25e 100644
--- a/.github/workflows/android-play-store-release.yml
+++ b/.github/workflows/android-play-store-release.yml
@@ -93,7 +93,7 @@ jobs:
       promote: ${{ steps.options.outputs.promote }}
       rollout_fraction: ${{ steps.options.outputs.rollout_fraction }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + tags: release notes cover the range since the previous tag.
           fetch-depth: 0
@@ -143,7 +143,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -214,7 +214,7 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby and fastlane (cached)
         uses: ruby/setup-ruby@v1
@@ -240,7 +240,7 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Ruby and fastlane (cached)
         uses: ruby/setup-ruby@v1
diff --git a/.github/workflows/artifact-storage.yml b/.github/workflows/artifact-storage.yml
index 99a3f16..6f8cdbb 100644
--- a/.github/workflows/artifact-storage.yml
+++ b/.github/workflows/artifact-storage.yml
@@ -129,7 +129,7 @@ jobs:
       s3_prefix_mappings: ${{ steps.label.outputs.s3_prefix_mappings }}
       is_release: ${{ steps.label.outputs.is_release }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -206,7 +206,7 @@ jobs:
       run:
         working-directory: ios/EthosProtocol
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -335,7 +335,7 @@ jobs:
 
       - name: Upload .ipa as GitHub Actions artifact (fallback / inspection)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ios-ipa-${{ needs.version.outputs.label }}
           path: |
@@ -361,12 +361,12 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -540,7 +540,7 @@ jobs:
 
       - name: Upload Android artifacts as GitHub Actions artifact (fallback / inspection)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-release-${{ needs.version.outputs.label }}
           path: |
@@ -563,7 +563,7 @@ jobs:
        github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Apply lifecycle rules to S3 bucket
         if: ${{ inputs.dry_run != true }}
diff --git a/.github/workflows/cert-pin-expiry-monitor.yml b/.github/workflows/cert-pin-expiry-monitor.yml
index b37ea76..efa6024 100644
--- a/.github/workflows/cert-pin-expiry-monitor.yml
+++ b/.github/workflows/cert-pin-expiry-monitor.yml
@@ -29,10 +29,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
@@ -76,7 +76,7 @@ jobs:
       # even when the step above continues-on-error.
       - name: Upload expiry report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: cert-expiry-report-${{ github.run_id }}
           path: cert-expiry-report.json
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 4fec408..bf411fe 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Check out pull request merge ref
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -56,7 +56,7 @@ jobs:
 
       - name: Skip non-patch updates
         if: steps.metadata.outputs.update-type != 'version-update:semver-patch'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const type = '${{ steps.metadata.outputs.update-type }}' || 'unknown';
diff --git a/.github/workflows/e2e-cross-platform.yml b/.github/workflows/e2e-cross-platform.yml
index ca20f3d..9fe9b34 100644
--- a/.github/workflows/e2e-cross-platform.yml
+++ b/.github/workflows/e2e-cross-platform.yml
@@ -68,7 +68,7 @@ jobs:
     env:
       API_BASE_URL: ${{ needs.preflight.outputs.api_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select Xcode
         run: sudo xcode-select -s /Applications/Xcode.app
@@ -113,7 +113,7 @@ jobs:
 
       - name: Upload iOS E2E results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ios-e2e-results
           path: ios/EthosProtocol/DerivedData/Logs/Test/*.xcresult
@@ -133,10 +133,10 @@ jobs:
     env:
       API_BASE_URL: ${{ needs.preflight.outputs.api_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -179,7 +179,7 @@ jobs:
 
       - name: Upload Android E2E results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-e2e-results
           path: android/app/build/reports/androidTests/connected/
@@ -211,7 +211,7 @@ jobs:
     env:
       API_BASE_URL: ${{ needs.preflight.outputs.api_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Creates one vault + one beneficiary invitation against the shared
       # staging backend and hands the resulting deep-link URL (with its real
@@ -247,7 +247,7 @@ jobs:
       E2E_INVITATION_TOKEN: ${{ needs.acceptance-flow-fixture.outputs.invitation_token }}
       E2E_VAULT_ID: ${{ needs.acceptance-flow-fixture.outputs.vault_id }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select Xcode
         run: sudo xcode-select -s /Applications/Xcode.app
@@ -318,10 +318,10 @@ jobs:
       E2E_INVITATION_TOKEN: ${{ needs.acceptance-flow-fixture.outputs.invitation_token }}
       E2E_VAULT_ID: ${{ needs.acceptance-flow-fixture.outputs.vault_id }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -379,7 +379,7 @@ jobs:
 
       - name: Upload Android acceptance-flow E2E results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-acceptance-flow-e2e-results
           path: android/app/build/reports/androidTests/connected/
@@ -399,10 +399,10 @@ jobs:
     env:
       API_BASE_URL: ${{ needs.preflight.outputs.api_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -454,7 +454,7 @@ jobs:
 
       - name: Upload offline-sync E2E results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-offline-sync-e2e-results
           path: android/app/build/reports/androidTests/connected/
@@ -470,7 +470,7 @@ jobs:
     env:
       API_BASE_URL: ${{ needs.preflight.outputs.api_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select Xcode
         run: sudo xcode-select -s /Applications/Xcode.app
diff --git a/.github/workflows/ios-app-store-release.yml b/.github/workflows/ios-app-store-release.yml
index 79c8f57..e45d8e7 100644
--- a/.github/workflows/ios-app-store-release.yml
+++ b/.github/workflows/ios-app-store-release.yml
@@ -81,7 +81,7 @@ jobs:
       upload_screenshots: ${{ steps.options.outputs.upload_screenshots }}
       run_app_store: ${{ steps.options.outputs.run_app_store }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + tags: release notes and change detection diff
           # against the previous vX.Y.Z tag.
@@ -222,7 +222,7 @@ jobs:
       run:
         working-directory: ios/EthosProtocol
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ios-applinks-verify.yml b/.github/workflows/ios-applinks-verify.yml
index 1d1d573..87667f2 100644
--- a/.github/workflows/ios-applinks-verify.yml
+++ b/.github/workflows/ios-applinks-verify.yml
@@ -28,7 +28,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Verify apple-app-site-association
         env:
@@ -44,7 +44,7 @@ jobs:
       # new one when none exists.
       - name: Alert on failure (scheduled run)
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const title = "⚠️ apple-app-site-association verification failed (scheduled check)";
diff --git a/.github/workflows/ios-beta-distribution.yml b/.github/workflows/ios-beta-distribution.yml
index 7c71fef..63ea00b 100644
--- a/.github/workflows/ios-beta-distribution.yml
+++ b/.github/workflows/ios-beta-distribution.yml
@@ -76,7 +76,7 @@ jobs:
       expiry_days: ${{ steps.beta_dist.outputs.expiry_days }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history + tags: release notes are generated from commits since
           # the previous vX.Y.Z tag.
diff --git a/.github/workflows/ios-ci.yml b/.github/workflows/ios-ci.yml
index 263da72..e6adc77 100644
--- a/.github/workflows/ios-ci.yml
+++ b/.github/workflows/ios-ci.yml
@@ -14,7 +14,7 @@ jobs:
   build-and-test:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Runs before any Xcode toolchain/build work: this only needs the
       # checked-out sources (the script itself + the target Info.plists),
@@ -96,7 +96,7 @@ jobs:
       - name: Review dependency changes for high severity vulnerabilities
         if: github.event_name == 'pull_request'
         continue-on-error: true
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         # Non-blocking: dependency-review requires the Dependency graph feature
         # to be enabled in repo settings (Settings → Security → Code security).
         # If it is disabled the action errors with "not supported on this
@@ -296,7 +296,7 @@ jobs:
       run:
         working-directory: ios/EthosProtocol
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select Xcode
         run: sudo xcode-select -s /Applications/Xcode.app
diff --git a/.github/workflows/ios-dependency-check.yml b/.github/workflows/ios-dependency-check.yml
index c045e62..1efae4b 100644
--- a/.github/workflows/ios-dependency-check.yml
+++ b/.github/workflows/ios-dependency-check.yml
@@ -31,7 +31,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select Xcode
         run: sudo xcode-select -s /Applications/Xcode.app
@@ -58,7 +58,7 @@ jobs:
 
       - name: Alert on failure (scheduled run)
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.issues.create({
diff --git a/.github/workflows/release-notes-parity-check.yml b/.github/workflows/release-notes-parity-check.yml
index 77eb2fa..5e41fdc 100644
--- a/.github/workflows/release-notes-parity-check.yml
+++ b/.github/workflows/release-notes-parity-check.yml
@@ -9,10 +9,10 @@ jobs:
   validate-parity-gap-claims:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml
index c4778c4..b1f6fe9 100644
--- a/.github/workflows/staging-deploy.yml
+++ b/.github/workflows/staging-deploy.yml
@@ -44,10 +44,10 @@ jobs:
       run:
         working-directory: android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -84,7 +84,7 @@ jobs:
           echo "Staging APK: $APK ($(numfmt --to=iec $SIZE))"
 
       - name: Upload staging APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: android-staging-apk
           path: android/app/build/outputs/apk/staging/
@@ -99,7 +99,7 @@ jobs:
       run:
         working-directory: ios/EthosProtocol
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Select Xcode
         run: sudo xcode-select -s /Applications/Xcode.app
diff --git a/.github/workflows/staging-smoke-test.yml b/.github/workflows/staging-smoke-test.yml
index b43dbcf..eafc6a9 100644
--- a/.github/workflows/staging-smoke-test.yml
+++ b/.github/workflows/staging-smoke-test.yml
@@ -24,7 +24,7 @@ jobs:
     name: Smoke test staging (auth, list vaults, check-in)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Run staging smoke tests
         env: