diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9cfc00c..f2bacc7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,8 +14,8 @@ jobs:
       matrix:
         node-version: [20, 22]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index c5f442d..a0d5642 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install OpenProse skill
         # Pinned to a commit rather than tracking the default branch. This skill
@@ -35,7 +35,7 @@ jobs:
           mkdir -p .claude/skills
           cp -r /tmp/prose/skills/open-prose .claude/skills/open-prose
 
-      - uses: anthropics/claude-code-action@c038e4dcdedfbbca18dfb17df35a17e40ded4ddc # v1.0.186
+      - uses: anthropics/claude-code-action@6b082c41935b4c8a3b8b0ef85ba4ba4d9eeb8975 # v1.0.189
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: "prose run pr-review.prose"
diff --git a/.github/workflows/press-eval-full.yml b/.github/workflows/press-eval-full.yml
index 85190ed..ca5fd70 100644
--- a/.github/workflows/press-eval-full.yml
+++ b/.github/workflows/press-eval-full.yml
@@ -23,9 +23,9 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           repository: openprose/prose
           # Pinned: without a ref this tracks that repository's default branch,
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
           path: prose
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -81,7 +81,7 @@ jobs:
 
       - name: Upload eval results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: eval-results-${{ github.sha }}-${{ inputs.tier || 'standard' }}
           path: eval-results/
diff --git a/.github/workflows/press-eval.yml b/.github/workflows/press-eval.yml
index c1f9eb5..784c6c8 100644
--- a/.github/workflows/press-eval.yml
+++ b/.github/workflows/press-eval.yml
@@ -17,9 +17,9 @@ jobs:
     if: ${{ vars.HAS_EVAL_SECRETS == 'true' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -36,7 +36,7 @@ jobs:
 
       - name: Upload eval results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: eval-results-${{ github.sha }}
           path: eval-results/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cc15d16..c20fd97 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,12 +11,12 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Nothing here writes to the repository, so leave no git credential on
           # disk for the build and test steps to reach.
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm