diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 1002918..0f4c918 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -155,8 +155,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1fd80ed..6dc0bfc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,8 +62,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -123,9 +123,9 @@ jobs:
             backend: flask
             dash: "4.4.0"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python }}
           cache: pip
@@ -206,14 +206,14 @@ jobs:
     timeout-minutes: 25
     needs: [test]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The same build Render runs. This is where a dependency-resolution
       # failure surfaces — at CI time, not deploy time, where the only signal
       # is a dashboard log while the old image keeps serving.
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
       - name: Build the production image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           tags: llms-2plot-dev:ci
@@ -293,8 +293,8 @@ jobs:
     # 2am. The report is the value; flip this off once the baseline is quiet.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - run: pip install pip-audit