diff --git a/.github/workflows/codequality.yml b/.github/workflows/codequality.yml
index 28865336..5f1920e3 100644
--- a/.github/workflows/codequality.yml
+++ b/.github/workflows/codequality.yml
@@ -57,7 +57,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           comment-summary-in-pr: always
 
diff --git a/.github/workflows/coding-agent-pr-gate.yml b/.github/workflows/coding-agent-pr-gate.yml
index 4d62a212..50d01787 100644
--- a/.github/workflows/coding-agent-pr-gate.yml
+++ b/.github/workflows/coding-agent-pr-gate.yml
@@ -19,7 +19,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Verify every checkbox in PR body is ticked
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const body = context.payload.pull_request.body || '';
diff --git a/.github/workflows/contract-changed.yml b/.github/workflows/contract-changed.yml
index fb9b419d..e8e2f8e8 100644
--- a/.github/workflows/contract-changed.yml
+++ b/.github/workflows/contract-changed.yml
@@ -24,7 +24,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Verify PR body contains a populated Consumer impact section
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const body = context.payload.pull_request.body || '';
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index fabc6b90..93d617c5 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
     - name: Dependabot metadata
       id: metadata
-      uses: dependabot/fetch-metadata@v2
+      uses: dependabot/fetch-metadata@v3
       with:
         github-token: "${{ secrets.GITHUB_TOKEN }}"
     - name: Enable auto-merge for Dependabot PRs