diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4066720..11d0a31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,20 +26,20 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Checkout emulebb-rust
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Checkout emulebb-miniupnp (native C source)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: emulebb/emulebb-miniupnp
           ref: ${{ env.MINIUPNP_REF }}
           path: .ci/emulebb-miniupnp
 
       - name: Install pinned Rust
-        uses: dtolnay/rust-toolchain@1.97.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -67,25 +67,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout emulebb-rust
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # clippy --workspace builds emulebb-miniupnpc-sys, whose build.rs compiles
       # the vendored MiniUPnP C source; provide it exactly as the build-test job
       # does so the clippy step is not blocked on a native build failure.
       - name: Checkout emulebb-miniupnp (native C source)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: emulebb/emulebb-miniupnp
           ref: ${{ env.MINIUPNP_REF }}
           path: .ci/emulebb-miniupnp
 
       - name: Install pinned Rust with rustfmt and Clippy
-        uses: dtolnay/rust-toolchain@1.97.0
+        uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: rustfmt, clippy
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -99,9 +99,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout emulebb-rust
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: cargo-deny — advisories, licenses, and sources
-        uses: EmbarkStudios/cargo-deny-action@8f84122a46a358a27cb0625d85ad60ab436a1b87 # v2
+        uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2
         with:
           command: check advisories licenses sources
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 886a1f3..5908af2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,22 +28,22 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout emulebb-rust
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
 
       - name: Checkout emulebb-miniupnp (native C source)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: emulebb/emulebb-miniupnp
           ref: ${{ env.MINIUPNP_REF }}
           path: .ci/emulebb-miniupnp
 
       - name: Install pinned Rust
-        uses: dtolnay/rust-toolchain@1.97.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -66,7 +66,7 @@ jobs:
           --out "$RELEASE_OUT_DIR"
 
       - name: Publish to the GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             ${{ env.RELEASE_OUT_DIR }}/*.zip