diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe28334..1cb64c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,13 +21,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Lint GitHub Workflows (Prevents runner vulnerabilities)
-        uses: devops-actions/actionlint@v0.1.3
+        uses: devops-actions/actionlint@v0.1.12
 
       - name: Set up Python (Using uv for ultra-fast package caching)
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
           python-version: "3.12"
@@ -56,13 +56,13 @@ jobs:
       image: semgrep/semgrep:latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run Semgrep Scan
         run: semgrep scan --config auto --sarif --output=semgrep-results.sarif .
 
       - name: Upload Semgrep results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always() && github.event_name != 'pull_request'
         with:
           sarif_file: semgrep-results.sarif
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       # Pinned securely to v0.36.0 commit SHA to mitigate CVE-2026-33634
       - name: Run Trivy File System Scanner
@@ -88,7 +88,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always() && github.event_name != 'pull_request'
         with:
           sarif_file: trivy-results.sarif