diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5a19a10..fbd8ac5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,17 +10,17 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Checkout proto sibling (replace ../proto)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.GITHUB_TOKEN }}
           path: _proto_ci
       - run: mv _proto_ci ../proto
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: '1.24'
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e26ddc9..7d08b06 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,24 +20,24 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: common/go.mod
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: go
           queries: security-extended
       - name: Build
         working-directory: common
         run: go build ./...
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
         with:
           category: "/language:go"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7ac6d10..0772376 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,24 +14,24 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           path: common
           # Full history so diff-cover can resolve origin/<base_ref> for the
           # patch-coverage gate below (shallow clones lack the base commit).
           fetch-depth: 0
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: common/go.mod
       - name: Generate coverage
         working-directory: common
         run: go test ./... -short -coverprofile=coverage.out -covermode=atomic
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         if: always()
         with:
           files: common/coverage.out
@@ -44,7 +44,7 @@ jobs:
       # Tool: diff-cover (https://github.com/Bachmann1234/diff-cover) reads a
       # Cobertura report + the git diff vs the base branch.
       # ------------------------------------------------------------------
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index fd90e7a..eb1a73d 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -17,15 +17,15 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: common/go.mod
           check-latest: true
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 5e46750..2c07a4d 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 89d7540..ecb52e6 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   scan:
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.1
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index d25ee6b..2fe6130 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v4
-      - uses: crate-ci/typos@v1.30.0
+      - uses: actions/checkout@v6
+      - uses: crate-ci/typos@v1.46.2
         continue-on-error: true  # warn-only — surface findings without blocking CI