diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98e6290..38af233 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,8 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           # Track the latest 1.26 patch automatically so security fixes
           # land in CI without needing to bump go.mod every patch release.
@@ -68,8 +68,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           # Track the latest 1.26 patch automatically so security fixes
           # land in CI without needing to bump go.mod every patch release.
@@ -118,7 +118,7 @@ jobs:
       # Codecov now requires a token even on public repos for reliable
       # ingestion. CODECOV_TOKEN is set as a repository secret. Failures
       # stay non-fatal so a codecov.io outage doesn't break the build.
-      - uses: codecov/codecov-action@v6
+      - uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.out
@@ -172,8 +172,8 @@ jobs:
             url: http://localhost:8583/Microsoft-Server-ActiveSync
             device: integration00000000000000000003
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           # Track the latest 1.26 patch automatically so security fixes
           # land in CI without needing to bump go.mod every patch release.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 964429c..f09f54e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,9 +26,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.26'
           check-latest: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7b8c127..4f7fd6a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # full history so release notes can diff against the previous tag
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.26'
           check-latest: true