diff --git a/.github/workflows/dependabot-insights.yml b/.github/workflows/dependabot-insights.yml
index ab981c8de4..571dd24c06 100644
--- a/.github/workflows/dependabot-insights.yml
+++ b/.github/workflows/dependabot-insights.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4  # ✅ Official action, safe to use
+        uses: actions/checkout@v7  # ✅ Official action, safe to use
 
       - name: Install GitHub CLI
         run: |
@@ -26,4 +26,3 @@ jobs:
           GH_TOKEN: ${{ secrets.DEPENDABOT_SECRET }}
         run: |
           bash .github/scripts/dependabot-group-alerts.sh
-
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index c45ecc857c..d756287e01 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -57,13 +57,13 @@ jobs:
         working-directory: ./embabel-agent-docs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install Graphviz
         run: |
           sudo apt-get update
           sudo apt-get install -y graphviz
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -92,13 +92,13 @@ jobs:
 
       - name: Google Auth
         id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           credentials_json: ${{secrets.GCP_SERVICE_ACCOUNT_CREDENTIALS}}
           service_account: embabel-ci-build@embabel-dev.iam.gserviceaccount.com
       
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@v3
 
       - name: Deploy archive to VM
         run: |
@@ -153,7 +153,7 @@ jobs:
               curl -I http://localhost/embabel-agent/guide/$VERSION/index.html || echo 'Versioned guide not responding'
             "
       - name: Trigger acceptance repo workflow to validate User Guide
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ secrets.PAT_TOKEN }}
           repository: embabel/embabel-acceptance-tests
diff --git a/.github/workflows/deploy-snapshots.yml b/.github/workflows/deploy-snapshots.yml
index ae7f1617f4..406c9b56e1 100644
--- a/.github/workflows/deploy-snapshots.yml
+++ b/.github/workflows/deploy-snapshots.yml
@@ -17,15 +17,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: 'temurin'
           cache: maven
       - name: Configure Maven Settings
-        uses: s4u/maven-settings-action@v2.8.0
+        uses: s4u/maven-settings-action@v4.0.0
         with:
           servers: ${{secrets.EMBABEL_ARTIFACTORY}}
       - name: Build and analyze
@@ -65,8 +65,8 @@ jobs:
           - embabel/urbot
     steps:
       - name: Trigger downstream workflow
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ secrets.PAT_TOKEN }}
           repository: ${{ matrix.repo }}
-          event-type: agent-snapshots-deployed
\ No newline at end of file
+          event-type: agent-snapshots-deployed
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 340cbcddfa..ef8b7f62df 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -19,8 +19,8 @@ jobs:
     outputs:
       docs-changed: ${{ steps.filter.outputs.docs }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -36,9 +36,9 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -69,9 +69,9 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -94,7 +94,7 @@ jobs:
       needs.detect-changes.outputs.docs-changed == 'true'
     steps:
       - name: Trigger Publish Docs workflow
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         with:
           token: ${{ secrets.PAT_TOKEN }}
           repository: ${{ github.repository }}
diff --git a/.github/workflows/sync-primary-to-upgrade.yml b/.github/workflows/sync-primary-to-upgrade.yml
index 21c340f71b..436a2abbf6 100644
--- a/.github/workflows/sync-primary-to-upgrade.yml
+++ b/.github/workflows/sync-primary-to-upgrade.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.PAT_TOKEN || github.token }}
@@ -35,7 +35,7 @@ jobs:
 
       - name: Resolve source PR metadata
         id: source
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.PAT_TOKEN || github.token }}
           script: |
@@ -97,7 +97,7 @@ jobs:
 
       - name: Upload conflict report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: branch-sync-conflict-report
           path: .github/sync-reports/