diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f31468e..634db24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,13 +18,13 @@ jobs:
     name: Packages — Lint & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -47,13 +47,13 @@ jobs:
     name: Apps — Lint & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -70,13 +70,13 @@ jobs:
     name: Services — Lint & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -96,9 +96,9 @@ jobs:
     name: Contracts — Build & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: dtolnay/rust-toolchain@1.81.0
+      - uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Ensure Cargo cache directories exist
         run: |
@@ -108,7 +108,7 @@ jobs:
           mkdir -p $HOME/.cargo/git/db
           mkdir -p ${{ github.workspace }}/contracts/target
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/bin
@@ -150,13 +150,13 @@ jobs:
     name: Indexer — Build & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -170,7 +170,7 @@ jobs:
         with:
           components: rustfmt, clippy
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/bin
diff --git a/.github/workflows/release-gate.yml b/.github/workflows/release-gate.yml
index fd0a3bc..60bcdd9 100644
--- a/.github/workflows/release-gate.yml
+++ b/.github/workflows/release-gate.yml
@@ -29,13 +29,13 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -65,7 +65,7 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -73,7 +73,7 @@ jobs:
           targets: wasm32-unknown-unknown
 
       - name: Cache Cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/bin
@@ -119,13 +119,13 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -158,7 +158,7 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install promtool
         run: |
@@ -199,7 +199,7 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Verify required release documents
         run: |
@@ -263,13 +263,13 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -296,7 +296,7 @@ jobs:
     outputs:
       status: ${{ steps.result.outputs.status }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Verify version consistency
         run: |
@@ -378,7 +378,7 @@ jobs:
     runs-on: ubuntu-latest
     if: always()
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build gate summary
         id: summary
@@ -494,7 +494,7 @@ jobs:
 
       - name: Upload gate report artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-gate-report-${{ github.ref_name }}
           path: release-gate-report/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6dd57e5..bdde470 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,10 +32,10 @@ jobs:
     outputs:
       report: ${{ steps.report.outputs.json }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@1.81.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Add wasm32 target
         run: rustup target add wasm32-unknown-unknown
@@ -58,7 +58,7 @@ jobs:
 
       - name: Upload dry-run report
         id: report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dry-run-report
           path: contracts/dry-run-report.json
@@ -75,17 +75,17 @@ jobs:
     needs: dry-run
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -122,10 +122,10 @@ jobs:
     needs: dry-run
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@1.81.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Add wasm32 target
         run: rustup target add wasm32-unknown-unknown
@@ -150,7 +150,7 @@ jobs:
             --output account/target/wasm32-unknown-unknown/release/ancore_account.optimized.wasm
 
       - name: Upload contract artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: contracts
           path: |
@@ -163,18 +163,18 @@ jobs:
     runs-on: ubuntu-latest
     if: env.DRY_RUN == 'false'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Download contract artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: contracts
           path: contracts-build
 
       - name: Download dry-run report
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dry-run-report
           path: .
@@ -191,7 +191,7 @@ jobs:
           echo '```' >> CHANGELOG.md
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           body_path: CHANGELOG.md
           files: |
@@ -208,7 +208,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.inputs.rollback_tag != ''
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -225,12 +225,12 @@ jobs:
           fi
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
diff --git a/.github/workflows/rollback-drill.yml b/.github/workflows/rollback-drill.yml
index 210b0a8..f7a7b29 100644
--- a/.github/workflows/rollback-drill.yml
+++ b/.github/workflows/rollback-drill.yml
@@ -42,7 +42,7 @@ jobs:
       dry_run: ${{ steps.tags.outputs.dry_run }}
       env: ${{ steps.tags.outputs.env }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -79,7 +79,7 @@ jobs:
     if: needs.resolve-tags.outputs.release_tag != 'skip'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -110,7 +110,7 @@ jobs:
 
       - name: Upload drill artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: rollback-drill-${{ needs.resolve-tags.outputs.release_tag }}-${{ github.run_id }}
           path: rollback-artifacts/
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 9b8eb33..606c5bd 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -10,15 +10,15 @@ jobs:
     name: Dependency Review
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -31,7 +31,7 @@ jobs:
         continue-on-error: true
 
       - name: Check for known vulnerabilities
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         if: github.event_name == 'pull_request'
 
   codeql:
@@ -45,7 +45,7 @@ jobs:
       matrix:
         language: ['javascript', 'typescript']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/validate-observability.yml b/.github/workflows/validate-observability.yml
index 21efe44..12d0af8 100644
--- a/.github/workflows/validate-observability.yml
+++ b/.github/workflows/validate-observability.yml
@@ -13,7 +13,7 @@ jobs:
     name: Lint Prometheus Alert Rules
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install promtool
         run: |
@@ -33,7 +33,7 @@ jobs:
     name: Lint Alertmanager Config
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install amtool
         run: |
@@ -54,7 +54,7 @@ jobs:
     name: Validate Grafana Dashboard JSON
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Validate JSON syntax and required fields
         run: |
@@ -93,7 +93,7 @@ jobs:
     name: Check Runbook Completeness
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Verify every alert has a runbook_url
         run: |
@@ -139,7 +139,7 @@ jobs:
     name: Check SLO Document Exists
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Verify SLO definitions file
         run: |
           test -f docs/ops/slo-definitions.md || \