diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4d7e934..753851f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -41,7 +41,7 @@ jobs:
       # setup-java still exports JAVA_HOME_<version>_<arch> for both, and
       # setup-gradle registers them as toolchain candidates.
       - name: Set up JDKs (test=${{ matrix.java }}, compile/daemon=17)
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -49,14 +49,14 @@ jobs:
             17
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build, test, lint, coverage
         run: ./gradlew build -PtestJdk=${{ matrix.java }} --stacktrace
 
       - name: Upload test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-reports-jdk${{ matrix.java }}
           path: |
@@ -93,7 +93,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDKs (test=${{ matrix.java }}, compile/daemon=17)
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -101,7 +101,7 @@ jobs:
             17
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Run integration tests against live API
         env:
@@ -116,7 +116,7 @@ jobs:
 
       - name: Upload integration-test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: integration-test-reports-jdk${{ matrix.java }}
           path: |
diff --git a/.github/workflows/pr-integration-on-demand.yml b/.github/workflows/pr-integration-on-demand.yml
index 942f27f..4138e48 100644
--- a/.github/workflows/pr-integration-on-demand.yml
+++ b/.github/workflows/pr-integration-on-demand.yml
@@ -158,7 +158,7 @@ jobs:
       # only supports JDKs up to 23 as its daemon runtime). The matrix
       # JDK is still installed and registered as a toolchain target.
       - name: Set up JDKs (test=${{ matrix.java }}, compile/daemon=17)
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -166,7 +166,7 @@ jobs:
             17
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Run integration tests against live API
         env:
@@ -181,7 +181,7 @@ jobs:
 
       - name: Upload integration-test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: integration-test-reports-jdk${{ matrix.java }}
           path: |
diff --git a/.github/workflows/pr-matrix-on-demand.yml b/.github/workflows/pr-matrix-on-demand.yml
index b1f590f..3d94b4e 100644
--- a/.github/workflows/pr-matrix-on-demand.yml
+++ b/.github/workflows/pr-matrix-on-demand.yml
@@ -114,7 +114,7 @@ jobs:
       # doesn't support JDK 24+ as its daemon runtime). The matrix JDK
       # is still installed and registered as a toolchain target.
       - name: Set up JDKs (test=${{ matrix.java }}, compile/daemon=17)
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -122,14 +122,14 @@ jobs:
             17
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Test on JDK ${{ matrix.java }}
         run: ./gradlew test -PtestJdk=${{ matrix.java }} --stacktrace
 
       - name: Upload test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-reports-jdk${{ matrix.java }}
           path: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3a8c65d..6d3662b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -81,13 +81,13 @@ jobs:
           ref: ${{ inputs.ref || github.sha }}
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build and test
         run: ./gradlew clean build -PsdkVersion="$VERSION"
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 66046be..788a4e7 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -98,7 +98,7 @@ jobs:
       # PRs only run on JDK 17 (the minimum target). Forward-compat
       # regressions on JDK 21/25 are caught post-merge by main.yml.
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: '17'
@@ -106,14 +106,14 @@ jobs:
       # Validates the wrapper jar hash and caches Gradle home + wrapper
       # dists between runs.
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build, test, lint, coverage
         run: ./gradlew build --stacktrace
 
       - name: Upload test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-reports
           path: |
@@ -175,13 +175,13 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: '17'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       # SDK requirements §17.3: a missing token fails the job, never skips it.
       - name: Run integration tests against live API
@@ -197,7 +197,7 @@ jobs:
 
       - name: Upload integration-test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: integration-test-reports-jdk17
           path: |
diff --git a/.github/workflows/tag-and-release.yml b/.github/workflows/tag-and-release.yml
index c5f5d90..8c227d5 100644
--- a/.github/workflows/tag-and-release.yml
+++ b/.github/workflows/tag-and-release.yml
@@ -79,7 +79,7 @@ jobs:
       # (compile + Gradle daemon runtime). Order matters — setup-java points
       # JAVA_HOME at the LAST entry, so 17 must be last for matrix.java = 25.
       - name: Set up JDKs (test=${{ matrix.java }}, compile/daemon=17)
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -87,7 +87,7 @@ jobs:
             17
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Build, test, lint, coverage
         env:
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload test reports on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-test-reports-jdk${{ matrix.java }}
           path: |