diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd706653..de35b1ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,7 +54,7 @@ jobs:
             || opam switch create . ocaml-base-compiler.4.14.2 --no-install --yes
           opam exec -- ocaml -version
       - name: Set up Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: "20"
       - name: Set up Bun
@@ -250,7 +250,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload bench log
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: bench-output
           path: bench-output.log
@@ -276,7 +276,7 @@ jobs:
       - name: Install dependencies
         run: opam install . --deps-only --with-test --with-doc --yes
       - name: Set up Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: "20"
       - name: Install tree-sitter CLI (for res-to-affine walker tests)
@@ -315,7 +315,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload coverage HTML
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: coverage-html
           path: _coverage
@@ -342,7 +342,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
       - name: Set up Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: "20"
       - name: Install test runner dependencies
@@ -387,7 +387,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
       - name: Set up Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@v7.1.0
         with:
           node-version: "20"
       - name: Install tree-sitter CLI
diff --git a/.github/workflows/panic-attack.yml b/.github/workflows/panic-attack.yml
index 7b566e22..4a6a6981 100644
--- a/.github/workflows/panic-attack.yml
+++ b/.github/workflows/panic-attack.yml
@@ -81,7 +81,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload log artifact
         if: always()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: panic-attack-log
           path: panic-attack.log
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 233fe4e7..eb8eeab0 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: hyperpolymath/smtp-notify-action@v0.3.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050)
+        uses: hyperpolymath/smtp-notify-action@v0.5.0 # NOSONAR — pin authority is actions.lock (sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050)
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}