diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index dd9cd13b..3593d293 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -39,23 +39,23 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
           cache-dependency-path: mobile/package-lock.json
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 21
 
       - name: Cache Gradle
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.gradle/caches
@@ -121,21 +121,21 @@ jobs:
           ls -la mobile/android/app/build/outputs/apk/release/*.apk
 
       - name: Upload Debug APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: debug-apk
           path: mobile/android/app/build/outputs/apk/debug/*.apk
           retention-days: 14
 
       - name: Upload Release AAB
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-aab
           path: mobile/android/app/build/outputs/bundle/release/*.aab
           retention-days: 30
 
       - name: Upload Release APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-apk
           path: mobile/android/app/build/outputs/apk/release/*.apk
@@ -153,7 +153,7 @@ jobs:
 
     steps:
       - name: Download Release AAB
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: release-aab
           path: artifacts
@@ -179,7 +179,7 @@ jobs:
 
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
@@ -188,7 +188,7 @@ jobs:
         run: echo "version=${GITHUB_REF_NAME#mobile@}" >> "$GITHUB_OUTPUT"
 
       - name: Create Release
-        uses: softprops/action-gh-release@c062e08bd532815e2082a7e09ce9f200309e996d # v2.2.1
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           name: "DeaMap Mobile v${{ steps.version.outputs.version }}"
           generate_release_notes: true
diff --git a/.github/workflows/build-ios.yml b/.github/workflows/build-ios.yml
index d4bd0fa6..2235ea3d 100644
--- a/.github/workflows/build-ios.yml
+++ b/.github/workflows/build-ios.yml
@@ -29,10 +29,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: npm
@@ -65,7 +65,7 @@ jobs:
         working-directory: mobile
 
       - name: Cache SPM packages
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ${{ runner.temp }}/spm-cache
           key: ${{ runner.os }}-spm-${{ hashFiles('mobile/ios/App/CapApp-SPM/Package.swift') }}
@@ -215,7 +215,7 @@ jobs:
 
       - name: Upload IPA artifact
         if: env.IOS_CERTIFICATE_P12_BASE64 != ''
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         env:
           IOS_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_CERTIFICATE_P12_BASE64 }}
         with:
@@ -224,7 +224,7 @@ jobs:
           retention-days: 30
 
       - name: Upload dSYMs artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: dsyms
           path: ${{ runner.temp }}/App.xcarchive/dSYMs/
@@ -266,13 +266,13 @@ jobs:
 
       - name: Checkout (for version.json)
         if: steps.check_secrets.outputs.skip != 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout: mobile/version.json
 
       - name: Download IPA
         if: steps.check_secrets.outputs.skip != 'true'
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-ipa
           path: artifacts
@@ -311,7 +311,7 @@ jobs:
 
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: artifacts
 
@@ -322,7 +322,7 @@ jobs:
       # Uses same release name as Android workflow — softprops/action-gh-release
       # is idempotent: creates if not exists, appends files if it does.
       - name: Append to Release
-        uses: softprops/action-gh-release@c062e08bd532815e2082a7e09ce9f200309e996d # v2.2.1
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           name: "DeaMap Mobile v${{ steps.version.outputs.version }}"
           generate_release_notes: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92ac60e7..5f6d0806 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Checkout base branch for comparison
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.base.ref }}
           path: base
@@ -120,10 +120,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
@@ -150,10 +150,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
@@ -174,10 +174,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
@@ -223,10 +223,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/ensure-tags.yml b/.github/workflows/ensure-tags.yml
index 41abccc3..ca22efbd 100644
--- a/.github/workflows/ensure-tags.yml
+++ b/.github/workflows/ensure-tags.yml
@@ -20,12 +20,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
 
@@ -76,7 +76,6 @@ jobs:
         run: |
           echo "🚀 Triggering release workflow for v${{ steps.mobile-tag.outputs.version }}"
           gh workflow run release-mobile-app.yml \
-            -f version=${{ steps.mobile-tag.outputs.version }} \
             -f deploy_android=true \
             -f deploy_ios=true \
             -f android_track=internal
diff --git a/.github/workflows/release-mobile-app.yml b/.github/workflows/release-mobile-app.yml
index c49c07f2..5e29f4cd 100644
--- a/.github/workflows/release-mobile-app.yml
+++ b/.github/workflows/release-mobile-app.yml
@@ -5,10 +5,6 @@ on:
     types: [published]
   workflow_dispatch:
     inputs:
-      version:
-        description: "Version to release (e.g., 1.0.0)"
-        required: true
-        type: string
       deploy_android:
         description: "Deploy to Google Play Store"
         required: false
@@ -54,6 +50,9 @@ jobs:
       build_number: ${{ steps.version.outputs.build_number }}
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
       - name: Get version
         id: version
         run: |
@@ -62,7 +61,9 @@ jobs:
             VERSION="${{ github.event.release.tag_name }}"
             VERSION="${VERSION#*@}"
           else
-            VERSION="${{ github.event.inputs.version }}"
+            # Always read from mobile/version.json — single source of truth
+            VERSION=$(node -p "require('./mobile/version.json').version")
+            echo "Read version from mobile/version.json: $VERSION"
           fi
 
           # Validate version format (x.y.z)
@@ -94,10 +95,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -127,23 +128,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
           cache-dependency-path: mobile/package-lock.json
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: ${{ env.JAVA_VERSION }}
 
       - name: Cache Gradle
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.gradle/caches
@@ -193,7 +194,7 @@ jobs:
           ./gradlew bundleRelease
 
       - name: Upload Release Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: app-release-android-${{ needs.prepare.outputs.version }}
           path: |
@@ -229,10 +230,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -264,10 +265,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
@@ -300,7 +301,7 @@ jobs:
         working-directory: mobile
 
       - name: Cache SPM packages
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ${{ runner.temp }}/spm-cache
           key: ${{ runner.os }}-spm-${{ hashFiles('mobile/ios/App/CapApp-SPM/Package.swift') }}
@@ -441,7 +442,7 @@ jobs:
           echo "ipa_name=${IPA_NAME}" >> "$GITHUB_OUTPUT"
 
       - name: Upload IPA artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: app-release-ios-${{ needs.prepare.outputs.version }}
           path: ${{ steps.ipa_info.outputs.ipa_path }}
@@ -485,7 +486,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -517,16 +518,19 @@ jobs:
       contents: write
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
       - name: Download Android artifacts
         if: needs.build-android.result == 'success'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: app-release-android-${{ needs.prepare.outputs.version }}
           path: ./android
 
       - name: Download iOS artifacts
         if: needs.build-ios.result == 'success'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: app-release-ios-${{ needs.prepare.outputs.version }}
           path: ./ios