diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 439ed81..9966158 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,15 +26,15 @@ jobs:
     name: Build, test, and package (Windows)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
-      - uses: actions/setup-dotnet@v5.3.0
+      - uses: actions/setup-dotnet@v6.0.0
         with:
           dotnet-version: 10.0.x
 
       # node/npm is required by the RestoreWebResources MSBuild target, which
       # restores the self-hosted client-side libraries (jquery) during build.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
 
@@ -119,15 +119,15 @@ jobs:
     name: Cross-platform build and unit tests (Linux)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
-      - uses: actions/setup-dotnet@v5.3.0
+      - uses: actions/setup-dotnet@v6.0.0
         with:
           dotnet-version: 10.0.x
 
       # node/npm is required by the RestoreWebResources MSBuild target, which
       # restores the self-hosted client-side libraries (jquery) during build.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
 
diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index 5a31484..b4c3c95 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -24,7 +24,7 @@ jobs:
     name: Verify installer RemotePayload metadata
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       - name: Restore installer packages (for heat.exe)
         run: nuget restore installer/IISAdministrationSetup/packages.config -SolutionDirectory installer
@@ -41,7 +41,7 @@ jobs:
       matrix:
         os: [windows-2025, windows-2022]
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v7.0.1
 
       # Exercises issue #329/#331: JWT validation must work at a negative UTC offset.
       - name: Set timezone to UTC-10
@@ -50,13 +50,13 @@ jobs:
           Set-TimeZone -Id 'Hawaiian Standard Time'
           Get-TimeZone
 
-      - uses: actions/setup-dotnet@v5.3.0
+      - uses: actions/setup-dotnet@v6.0.0
         with:
           dotnet-version: 10.0.x
 
       # node/npm is required by the RestoreWebResources MSBuild target, which
       # restores the self-hosted client-side libraries (jquery) during build.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22