diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3518ea4..3f080a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,9 +13,9 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
 
       - name: Install dependencies
         run: uv sync --extra dev
@@ -28,7 +28,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           files: coverage.xml
           fail_ci_if_error: false
@@ -37,9 +37,9 @@ jobs:
   smoke-macos:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
 
       - name: Install package
         run: uv tool install .
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index baa8da0..b76b88a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,15 +10,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v7
 
       - name: Build distributions
         run: uv build
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -32,7 +32,7 @@ jobs:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
@@ -51,7 +51,7 @@ jobs:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
@@ -66,7 +66,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0  # full history so --generate-notes can diff against previous tag
 
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 4bcbe2f..62d31fa 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -20,7 +20,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: EndBug/label-sync@v2
         with:
           config-file: .github/labels.yml
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f87a6b6..28c260d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/). Versions follow
 
 ### Changed
 
+- **Bump github-actions group: actions/checkout 4→6, astral-sh/setup-uv 5→7, codecov/codecov-action 5→6, actions/upload-artifact 4→7, actions/download-artifact 4→8** (#56)
 - **Migrated `pyproject.toml` to PEP 639 SPDX license form**: `license = {text = "Apache-2.0"}` (deprecated) replaced with `license = "Apache-2.0"` and `license-files = ["LICENSE"]`. The redundant `License :: OSI Approved :: Apache Software License` classifier was removed per PEP 639 guidance — the SPDX expression is now the single source of truth for license metadata, and the classifier will be forbidden in a future setuptools release. Hatchling (the build backend used here) supports PEP 639 natively.
 
 ## [0.5.0] - 2026-04-22