diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 63bc313..56a8a81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,8 +33,8 @@ jobs:
     name: Unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -80,7 +80,7 @@ jobs:
       run:
         working-directory: contracts
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       # rustup ships on the runner image; the toolchain file pins the channel and
       # the wasm target, so this only has to make sure the target is present.
@@ -90,7 +90,7 @@ jobs:
       # A cold Soroban SDK build is minutes of compile time, and the dependency
       # set only moves when the lockfile does.
       - name: Cache cargo
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry/index
@@ -117,7 +117,7 @@ jobs:
       # only `wave_pool` made the artifact silently incomplete — a deploy taking
       # "the bytes CI verified" would have found half of them missing.
       - name: Upload wasm
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: contracts-wasm
           path: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bd74724..bd588c3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,10 +22,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
         with:
           category: '/language:javascript-typescript'
diff --git a/.github/workflows/wave-escrow.yml b/.github/workflows/wave-escrow.yml
index cf9abfb..17a1c47 100644
--- a/.github/workflows/wave-escrow.yml
+++ b/.github/workflows/wave-escrow.yml
@@ -11,7 +11,7 @@ jobs:
   contract:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: wasm32v1-none
@@ -31,7 +31,7 @@ jobs:
         run: |
           set -o pipefail
           cargo test --locked --workspace --features wasm-tests -- --nocapture 2>&1 | tee test-output.txt
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: wave-escrow-evidence