diff --git a/.github/workflows/c5-regenerate.yml b/.github/workflows/c5-regenerate.yml
index 0655035..2b1b44d 100644
--- a/.github/workflows/c5-regenerate.yml
+++ b/.github/workflows/c5-regenerate.yml
@@ -51,7 +51,7 @@ jobs:
           path: affinescript
 
       - name: Install OCaml
-        uses: ocaml/setup-ocaml@v3.8.0
+        uses: ocaml/setup-ocaml@v3.9.0
         with:
           ocaml-compiler: '4.14.2'
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index a6ec77b..eee3880 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '25'
 
@@ -158,7 +158,7 @@ jobs:
 
       # ---- Node (for smoke test within E2E script) ----
       - name: Set up Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: '25'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4939a2d..3841579 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -77,7 +77,7 @@ jobs:
           git cliff --output CHANGELOG.md
 
       - name: Upload updated CHANGELOG.md
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: changelog
           path: CHANGELOG.md
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index c1e67b8..280523b 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -117,7 +117,7 @@ jobs:
           echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload panic-attack findings
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: panic-attack-findings
           path: panic-attack-findings.json
@@ -251,7 +251,7 @@ jobs:
           echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload hypatia findings
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json
@@ -341,7 +341,7 @@ jobs:
           echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload bridge report
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: bridge-report
           path: bridge-report.json
@@ -365,19 +365,19 @@ jobs:
 
     steps:
       - name: Download panic-attack findings
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: panic-attack-findings
           path: findings/
 
       - name: Download hypatia findings
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: hypatia-findings
           path: findings/
 
       - name: Download bridge report
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8.0.2
         with:
           name: bridge-report
           path: findings/
@@ -439,7 +439,7 @@ jobs:
           echo "low=$LOW"           >> "$GITHUB_OUTPUT"
 
       - name: Upload unified findings (fleet scanner picks these up)
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: unified-findings
           path: findings/unified-findings.json