diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31f2a92..bd2be51 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,10 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -97,7 +97,7 @@ jobs:
             fetch_depth: 0
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: ${{ matrix.fetch_depth }}
 
@@ -158,10 +158,10 @@ jobs:
           - plugin: fchub-wishlist
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -170,7 +170,7 @@ jobs:
 
       - name: Upload rejected package evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}-failure
           path: |
@@ -183,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # `Check for changes` below diffs against the pull request base, which
           # a depth-1 checkout does not contain: the diff fails, the count comes
@@ -199,7 +199,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -222,7 +222,7 @@ jobs:
 
       - name: Cache Playwright browsers
         if: steps.changes.outputs.count > 0
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('plugins/fchub-memberships/package-lock.json') }}
@@ -264,7 +264,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # `Check for changes` below diffs against the pull request base, which
           # a depth-1 checkout does not contain: the diff fails, the count comes
@@ -280,7 +280,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -320,7 +320,7 @@ jobs:
       # job remains because the repository asserts Stream is still here for a
       # possible return, not because anything is expected to run.
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check for changes
         id: changes
@@ -330,7 +330,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.changes.outputs.count > 0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
@@ -385,10 +385,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22'
 
diff --git a/.github/workflows/claude-interactive.yml b/.github/workflows/claude-interactive.yml
index 65f4caf..46e5e3c 100644
--- a/.github/workflows/claude-interactive.yml
+++ b/.github/workflows/claude-interactive.yml
@@ -27,7 +27,7 @@ jobs:
       group: claude-interactive-${{ github.event.issue.number || github.event.pull_request.number }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -39,7 +39,7 @@ jobs:
           coverage: none
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 0bfa962..70cfd37 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -22,7 +22,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index ec86f06..41bbb97 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -59,9 +59,9 @@ jobs:
     name: Version Consistency
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
 
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 454cb8e..3e2f81e 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -35,7 +35,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run Claude Code
         uses: anthropics/claude-code-action@v1
diff --git a/.github/workflows/mcp-ci.yml b/.github/workflows/mcp-ci.yml
index 5d1aa50..5c95f33 100644
--- a/.github/workflows/mcp-ci.yml
+++ b/.github/workflows/mcp-ci.yml
@@ -55,9 +55,9 @@ jobs:
     name: Quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'
@@ -77,9 +77,9 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'
@@ -131,9 +131,9 @@ jobs:
       source_sha: ${{ steps.identity.outputs.source_sha }}
       artifact_name: ${{ steps.identity.outputs.artifact_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'
@@ -224,7 +224,7 @@ jobs:
 
       # Immutable handoff. Every publication job consumes these bytes and their digests.
       - name: Upload release artefacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ env.RELEASE_ARTIFACT_NAME }}
           path: fluentcart-mcp/dist-packages/
diff --git a/.github/workflows/mcp-docker.yml b/.github/workflows/mcp-docker.yml
index 0c53be6..1c53b6f 100644
--- a/.github/workflows/mcp-docker.yml
+++ b/.github/workflows/mcp-docker.yml
@@ -60,7 +60,7 @@ jobs:
       source_sha: ${{ steps.build.outputs.source_sha }}
     steps:
       - name: Download validated artefacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact_name || needs.validate.outputs.artifact_name }}
           path: dist-packages
@@ -69,7 +69,7 @@ jobs:
       # SHA256SUMS.json before extracting a single byte, so the image cannot be built from
       # anything other than the archive that was inspected.
       - name: Checkout build tooling
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           sparse-checkout: |
             fluentcart-mcp/scripts
@@ -77,7 +77,7 @@ jobs:
             fluentcart-mcp/package.json
           sparse-checkout-cone-mode: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -210,7 +210,7 @@ jobs:
         run: docker save "${LOCAL_REPOSITORY}:${VERSION}" -o fluentcart-mcp-image.tar
 
       - name: Upload verified image
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ env.IMAGE_ARTIFACT }}
           path: fluentcart-mcp-image.tar
@@ -227,7 +227,7 @@ jobs:
       packages: write
     steps:
       - name: Download verified image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ env.IMAGE_ARTIFACT }}
 
@@ -235,14 +235,14 @@ jobs:
         run: docker load -i fluentcart-mcp-image.tar
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/mcp-release.yml b/.github/workflows/mcp-release.yml
index 4d63907..1b29d0f 100644
--- a/.github/workflows/mcp-release.yml
+++ b/.github/workflows/mcp-release.yml
@@ -70,12 +70,12 @@ jobs:
       id-token: write
     steps:
       - name: Download validated artefacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.validate.outputs.artifact_name }}
           path: dist-packages
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           registry-url: https://registry.npmjs.org
@@ -122,7 +122,7 @@ jobs:
       contents: write
     steps:
       - name: Download validated artefacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.validate.outputs.artifact_name }}
           path: dist-packages
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4f0ba09..b939e23 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
       is_wporg: ${{ steps.tag.outputs.is_wporg }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -96,12 +96,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout validated tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -165,7 +165,7 @@ jobs:
 
       - name: Download validated WordPress.org ZIP
         if: needs.prepare.outputs.is_wporg == 'true'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: wporg-package-${{ needs.prepare.outputs.slug }}
           path: dist
diff --git a/.github/workflows/wporg-release-gates.yml b/.github/workflows/wporg-release-gates.yml
index c040d4d..8b81f2e 100644
--- a/.github/workflows/wporg-release-gates.yml
+++ b/.github/workflows/wporg-release-gates.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate target and version
         env:
@@ -64,7 +64,7 @@ jobs:
           - '8.5'
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -95,10 +95,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm
@@ -149,12 +149,12 @@ jobs:
           - fchub-wishlist
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
@@ -184,7 +184,7 @@ jobs:
             "${{ matrix.plugin }}"
 
       - name: Upload validated package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}
           path: |
@@ -196,7 +196,7 @@ jobs:
 
       - name: Upload rejected package evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-package-${{ matrix.plugin }}-failure
           path: |
@@ -226,10 +226,10 @@ jobs:
           - '8.5'
     steps:
       - name: Checkout caller tag SHA
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Download validated package
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: wporg-package-${{ matrix.plugin }}
           path: dist
@@ -273,7 +273,7 @@ jobs:
 
       - name: Upload disposable gate evidence
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wporg-runtime-${{ matrix.plugin }}-php${{ matrix.php_version }}-failure
           path: test-results/wporg/${{ matrix.plugin }}/