diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6255bb6..677a73f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,9 +12,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -29,10 +29,10 @@ jobs:
       # pinned-pred environment used to score submissions. The image's default CMD is the
       # calibration self-test. GHA cache is shared with score-pr.yml / publish-on-merge.yml.
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build scoring image (pred + verifier)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
diff --git a/.github/workflows/publish-on-merge.yml b/.github/workflows/publish-on-merge.yml
index 4af7712..e2df6ae 100644
--- a/.github/workflows/publish-on-merge.yml
+++ b/.github/workflows/publish-on-merge.yml
@@ -31,13 +31,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build scoring image (pred + verifier)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
@@ -62,8 +62,8 @@ jobs:
           test -f results/scored/leaderboard.json
           cp results/scored/leaderboard.json site/results.json
 
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@v6
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -75,4 +75,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/score-pr.yml b/.github/workflows/score-pr.yml
index c28787b..953db27 100644
--- a/.github/workflows/score-pr.yml
+++ b/.github/workflows/score-pr.yml
@@ -32,7 +32,7 @@ jobs:
     outputs:
       mode: ${{ steps.classify.outputs.mode }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - id: classify
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: scoring          # ← maintainer must approve before pred touches the input
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: List submission files to score
@@ -65,7 +65,7 @@ jobs:
           git diff --name-only --diff-filter=AM "$base" "$head" -- 'submissions/**/*.json' > changed.txt
           echo "Will score:"; cat changed.txt
       - name: Build scoring image (pred + verifier)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
diff --git a/.github/workflows/validate-submission.yml b/.github/workflows/validate-submission.yml
index 5168158..21dfdf0 100644
--- a/.github/workflows/validate-submission.yml
+++ b/.github/workflows/validate-submission.yml
@@ -13,8 +13,8 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
       - run: pip install jsonschema