diff --git a/.github/workflows/appliance.yml b/.github/workflows/appliance.yml
index 3b03e4d..53ec843 100644
--- a/.github/workflows/appliance.yml
+++ b/.github/workflows/appliance.yml
@@ -39,13 +39,13 @@ jobs:
       # The release tag to attach to: the published release's tag, or a manually-supplied one. Blank = none.
       RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -121,15 +121,15 @@ jobs:
       # images from a non-release build, dispatch this workflow with upload_artifacts: true.
       - name: Upload Hyper-V appliance
         if: ${{ inputs.upload_artifacts }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with: { name: dispatch-appliance-hyperv, path: out/hyperv/*, if-no-files-found: error, retention-days: 1 }
       - name: Upload VMware appliance
         if: ${{ inputs.upload_artifacts }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with: { name: dispatch-appliance-vmware, path: out/vmware/*, if-no-files-found: error, retention-days: 1 }
       - name: Upload KVM/Proxmox appliance
         if: ${{ inputs.upload_artifacts }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with: { name: dispatch-appliance-kvm, path: out/kvm/*, if-no-files-found: error, retention-days: 1 }
 
       # Build the same zips a release would attach, and verify their contents - on EVERY run, not just
@@ -243,7 +243,7 @@ jobs:
 
       - name: Upload boot diagnostics
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: appliance-boot-diagnostics
           path: |
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a53852f..444a901 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,15 +39,15 @@ jobs:
       DOTNET_CLI_TELEMETRY_OPTOUT: "true"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -123,7 +123,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-results
           path: TestResults/**/*.trx
@@ -135,7 +135,7 @@ jobs:
   no-em-dash:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Reject em dashes (use ASCII '-')
         run: |
           matches=$(grep -rlIP '\x{2014}' . --exclude-dir=.git --exclude-dir=node_modules || true)
@@ -157,7 +157,7 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Build the appliance from this validated commit
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/cleanup-artifacts.yml b/.github/workflows/cleanup-artifacts.yml
index d70571c..a1c314e 100644
--- a/.github/workflows/cleanup-artifacts.yml
+++ b/.github/workflows/cleanup-artifacts.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Delete artifacts older than 3 days
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const cutoff = Date.now() - 3 * 24 * 60 * 60 * 1000;
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d3f8d9a..535d853 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -22,7 +22,7 @@ jobs:
   build-and-smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Build image + start the stack (Dispatch + PostgreSQL)
         run: docker compose up --build -d
diff --git a/.github/workflows/installers.yml b/.github/workflows/installers.yml
index e700337..cb421f4 100644
--- a/.github/workflows/installers.yml
+++ b/.github/workflows/installers.yml
@@ -31,15 +31,15 @@ jobs:
   windows-installer:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -100,7 +100,7 @@ jobs:
       # DispatchSetup.exe is the single distributable file - it embeds Dispatch.msi and chains PostgreSQL.
       # (The MSI is still built above to prove the WiX sources compile and to embed in the bundle.)
       - name: Upload installer artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dispatch-windows-installer
           path: installer/windows/DispatchSetup.exe
@@ -254,15 +254,15 @@ jobs:
     if: ${{ github.event_name == 'push' || inputs.full_install == true }}
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -312,15 +312,15 @@ jobs:
   linux-tarball:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -365,7 +365,7 @@ jobs:
           ls -lh "${stage}.tar.gz"
 
       - name: Upload tarball artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: dispatch-linux-tarball
           path: dispatch-ci-linux-x64.tar.gz
@@ -431,7 +431,7 @@ jobs:
   linux-installer:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Lint install.sh
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 37d4729..684598b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
     outputs:
       version: ${{ steps.ver.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Resolve version
         id: ver
@@ -56,12 +56,12 @@ jobs:
           echo "Building version $v"
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -98,7 +98,7 @@ jobs:
       # --- Sign the MSI (opt-in) ----------------------------------------------------------------
       - name: Azure login (signing)
         if: ${{ vars.AZURE_SIGNING_ACCOUNT != '' }}
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -106,7 +106,7 @@ jobs:
 
       - name: Sign the MSI
         if: ${{ vars.AZURE_SIGNING_ACCOUNT != '' }}
-        uses: azure/trusted-signing-action@fc390cf8ed0f14e248a542af1d838388a47c7a7c # v0.5
+        uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
         with:
           endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
           trusted-signing-account-name: ${{ vars.AZURE_SIGNING_ACCOUNT }}
@@ -140,7 +140,7 @@ jobs:
 
       - name: Sign the engine
         if: ${{ vars.AZURE_SIGNING_ACCOUNT != '' }}
-        uses: azure/trusted-signing-action@fc390cf8ed0f14e248a542af1d838388a47c7a7c # v0.5
+        uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
         with:
           endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
           trusted-signing-account-name: ${{ vars.AZURE_SIGNING_ACCOUNT }}
@@ -162,7 +162,7 @@ jobs:
 
       - name: Sign the bundle
         if: ${{ vars.AZURE_SIGNING_ACCOUNT != '' }}
-        uses: azure/trusted-signing-action@fc390cf8ed0f14e248a542af1d838388a47c7a7c # v0.5
+        uses: azure/trusted-signing-action@c7ab2a863ab5f9a846ddb8265964877ef296ee82 # v2.0.0
         with:
           endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
           trusted-signing-account-name: ${{ vars.AZURE_SIGNING_ACCOUNT }}
@@ -180,7 +180,7 @@ jobs:
         run: Copy-Item -Force bundlesign/DispatchSetup.exe DispatchSetup.exe
 
       - name: Upload Windows artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: windows
           # DispatchSetup.exe is the single distributable - it embeds the (signed) MSI.
@@ -191,7 +191,7 @@ jobs:
   linux:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Resolve version
         id: ver
@@ -200,12 +200,12 @@ jobs:
           echo "version=$v" >> "$GITHUB_OUTPUT"
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version: "24"
           cache: npm
@@ -257,7 +257,7 @@ jobs:
           ls -lh "${stage}.tar.gz"
 
       - name: Upload Linux artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: linux
           path: dispatch-*-linux.tar.gz
@@ -299,7 +299,7 @@ jobs:
           ls -lh "dispatch-upgrade-${ver}.tar.gz"
 
       - name: Upload upgrade package
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: upgrade-package
           path: dispatch-upgrade-*.tar.gz
@@ -313,16 +313,16 @@ jobs:
     if: ${{ github.ref_type == 'tag' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Set up QEMU (cross-arch emulation)
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -330,7 +330,7 @@ jobs:
 
       - name: Image metadata (tags + labels)
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository }}
           # full semver + major.minor; `latest` only for stable (non-prerelease) tags.
@@ -340,7 +340,7 @@ jobs:
             type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
 
       - name: Build + push multi-arch image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -372,7 +372,7 @@ jobs:
           ( cd release && sha256sum * > SHA256SUMS && cat SHA256SUMS )
 
       - name: Publish GitHub Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ github.ref_type == 'tag' && github.ref_name || format('v{0}', needs.windows.outputs.version) }}
           name: Dispatch ${{ needs.windows.outputs.version }}
diff --git a/.github/workflows/scripts.yml b/.github/workflows/scripts.yml
index 13946bd..085b1c1 100644
--- a/.github/workflows/scripts.yml
+++ b/.github/workflows/scripts.yml
@@ -17,7 +17,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Parse + analyze PowerShell
         shell: pwsh
         run: |
@@ -51,7 +51,7 @@ jobs:
   pester:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Pester (Hyper-V import logic, cmdlets mocked)
         shell: pwsh
         run: |