diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index abc296b5..176888c7 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -12,7 +12,7 @@ jobs:
   ansible-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ansible/ansible-lint@v26
         with:
           working_directory: installer/ansible
@@ -20,7 +20,7 @@ jobs:
   shellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: ludeeus/action-shellcheck@master
         with:
           additional_files: 'installer/install.sh tests/test.sh image-builder/*.sh image-builder/lib/*.sh image-builder/files/*.sh scripts/*.sh'
@@ -30,8 +30,8 @@ jobs:
   unit-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: pip install pyyaml "ansible-core==2.19.*"
@@ -40,8 +40,8 @@ jobs:
   python-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: pip install ruff mypy
@@ -54,7 +54,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Fetch tags
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a313524b..86bd3ca6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
       is_release: ${{ steps.meta.outputs.is_release }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -100,13 +100,13 @@ jobs:
           echo "Archive contents:"
           tar tzf "${{ steps.meta.outputs.archive_name }}" | head -30
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: playbooks-archive
           path: ${{ steps.meta.outputs.archive_name }}
           retention-days: 5
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: manifest
           path: staging/manifest.json
@@ -117,18 +117,18 @@ jobs:
     if: needs.build.outputs.is_release == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           sparse-checkout: |
             installer/install.sh
             installer/ansible/roles/upgrade/files/odio_upgrade.py
           sparse-checkout-cone-mode: false
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: playbooks-archive
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: manifest
 
@@ -154,18 +154,18 @@ jobs:
     if: needs.build.outputs.is_release == 'false' && github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           sparse-checkout: |
             installer/install.sh
             installer/ansible/roles/upgrade/files/odio_upgrade.py
           sparse-checkout-cone-mode: false
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: playbooks-archive
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: manifest
 
@@ -192,7 +192,7 @@ jobs:
     outputs:
       image: ${{ steps.meta.outputs.image }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Set image tag
         id: meta
@@ -240,7 +240,7 @@ jobs:
           - action: test-as-other-user
             rerun: rerun-as-other-user
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Run playbook (${{ matrix.action }})
         run: ./tests/test.sh ${{ matrix.action }}
@@ -273,7 +273,7 @@ jobs:
             experimental: true
     continue-on-error: ${{ matrix.experimental == true }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Set up QEMU
         if: matrix.qemu
@@ -301,7 +301,7 @@ jobs:
       matrix:
         mode: [install, install-root, install-as-other-user]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Resolve tag
         id: tag
@@ -425,7 +425,7 @@ jobs:
             baseline_variant: "-no-mpd-stack"
             test_action: upgrade-from-image-fetch
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Log in to GHCR
         uses: docker/login-action@v4
@@ -471,7 +471,7 @@ jobs:
           - arch: arm64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install build dependencies
         run: |
@@ -503,21 +503,21 @@ jobs:
             output/odio-*.json
 
       - name: Upload per-arch manifest entry
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: manifest-${{ matrix.arch }}
           path: output/odio-*.json
 
       - name: Upload per-arch RPi-Imager manifest (pre-release only)
         if: needs.build.outputs.is_release != 'true'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: rpi-imager-manifest-${{ matrix.arch }}
           path: odio.${{ matrix.arch }}.rpi-imager-manifest
 
       - name: Upload image as artifact
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: odio-${{ matrix.arch }}-${{ steps.tag.outputs.value }}
           path: output/odio-*.img.xz
@@ -541,7 +541,7 @@ jobs:
           fi
 
       - name: Download image artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: odio-*-${{ steps.tag.outputs.value }}
           path: images
@@ -549,7 +549,7 @@ jobs:
 
       - name: Download per-arch RPi-Imager manifests (pre-release only)
         if: needs.build.outputs.is_release != 'true'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: rpi-imager-manifest-*
           path: rpi-manifests
@@ -573,13 +573,13 @@ jobs:
     steps:
       # Checkout MUST run before download-artifact: actions/checkout wipes the
       # working directory, which would nuke `entries/` if the order were reversed.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           sparse-checkout: scripts/build-rpi-manifests.py
           sparse-checkout-cone-mode: false
 
       - name: Download manifest entries
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: manifest-*
           path: entries
diff --git a/.github/workflows/test-baseline-image.yml b/.github/workflows/test-baseline-image.yml
index 620e10fd..d0206d02 100644
--- a/.github/workflows/test-baseline-image.yml
+++ b/.github/workflows/test-baseline-image.yml
@@ -39,7 +39,7 @@ jobs:
   build-baseline:
     runs-on: ${{ inputs.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install dependencies (arm64)
         if: inputs.arch == 'arm64'
diff --git a/.github/workflows/test-image.yml b/.github/workflows/test-image.yml
index 6b846641..eee9e07c 100644
--- a/.github/workflows/test-image.yml
+++ b/.github/workflows/test-image.yml
@@ -14,7 +14,7 @@ jobs:
   build-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Log in to GHCR
         uses: docker/login-action@v4