diff --git a/.github/actions/cue/action.yml b/.github/actions/cue/action.yml
index 3e2f78f..82d8d51 100644
--- a/.github/actions/cue/action.yml
+++ b/.github/actions/cue/action.yml
@@ -4,7 +4,7 @@ inputs:
   schema-file:
     required: true
   cue-version:
-    default: 0.15.0
+    default: 0.16.0
 
 runs:
   using: "composite"
diff --git a/.github/workflows/check-versions.yml b/.github/workflows/check-versions.yml
index 3f33bd8..c555c0a 100644
--- a/.github/workflows/check-versions.yml
+++ b/.github/workflows/check-versions.yml
@@ -32,7 +32,7 @@ jobs:
       - name: upload-artifact
         uses: ninotosh/check-github-repo-latest-version@v1
         with:
-          release: actions/upload-artifact@v6
+          release: actions/upload-artifact@v7
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: cache
@@ -50,7 +50,7 @@ jobs:
       - name: setup-terraform
         uses: ninotosh/check-github-repo-latest-version@v1
         with:
-          release: hashicorp/setup-terraform@v3
+          release: hashicorp/setup-terraform@v4
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: terraform
@@ -74,7 +74,7 @@ jobs:
       - name: cue
         uses: ninotosh/check-github-repo-latest-version@v1
         with: 
-          release: cue-lang/cue@v0.15
+          release: cue-lang/cue@v0.16
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: openvpn
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 52d3fbb..75889cf 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -33,7 +33,7 @@ jobs:
       - run: make generated.servers.auto.tfvars.json
 
       - name: set up terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@v4
         with:
           terraform_version: ~1.14
           cli_config_credentials_token: ${{ secrets.HCP_TERRAFORM_TEAM_TOKEN }}
@@ -49,7 +49,7 @@ jobs:
       - run: terraform apply -auto-approve -refresh-only
 
       - name: set up terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@v4
         with:
           terraform_version: ~1.14
           cli_config_credentials_token: ${{ secrets.HCP_TERRAFORM_TEAM_TOKEN }}
@@ -107,7 +107,7 @@ jobs:
           -e download_dir=${DOWNLOAD_DIR}
           site.yml
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: ovpn_${{ github.run_number }}
           path: ${{ env.DOWNLOAD_DIR }}
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 668b83d..2b2d4fc 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: set up terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@v4
         with:
           terraform_version: ~1.14
           cli_config_credentials_token: ${{ secrets.HCP_TERRAFORM_TEAM_TOKEN }}
diff --git a/.github/workflows/keygen.yml b/.github/workflows/keygen.yml
index ca25743..53fb94e 100644
--- a/.github/workflows/keygen.yml
+++ b/.github/workflows/keygen.yml
@@ -16,7 +16,7 @@ jobs:
       # "y" to overwrite the tmp file
       - run: echo y | ssh-keygen -t ed25519 -f ${SSH_PRIVATE_KEY_PATH} -C $SSH_USER -N ""
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: ssh_key_pair_${{ github.run_number }}
           path: |
diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index 819584e..c7c1331 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -35,7 +35,7 @@ jobs:
       - run: make generated.servers.auto.tfvars.json
 
       - name: set up terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@v4
         with:
           terraform_version: ~1.14
           cli_config_credentials_token: ${{ secrets.HCP_TERRAFORM_TEAM_TOKEN }}
diff --git a/README.md b/README.md
index ca82ed4..f819c1e 100644
--- a/README.md
+++ b/README.md
@@ -86,11 +86,11 @@ sequenceDiagram
 
 - accounts
   - [GitHub](https://docs.github.com/en/get-started/start-your-journey/creating-an-account-on-github)
-  - [HCP Terraform](https://developer.hashicorp.com/terraform/tutorials/cloud-get-started/cloud-sign-up)
+  - [HashiCorp Cloud Platform](https://developer.hashicorp.com/hcp/docs/hcp/create-account) or [HCP Terraform](https://developer.hashicorp.com/terraform/tutorials/cloud-get-started/cloud-sign-up)
   - one or more of
     - [AWS](https://aws.amazon.com/resources/create-account/)
     - [Google](https://support.google.com/accounts/answer/27441) for Google Cloud
-- VPN client application
+- VPN client application on each client
 
 # steps
 
diff --git a/docker/cue.Dockerfile b/docker/cue.Dockerfile
index eaf331b..d423f42 100644
--- a/docker/cue.Dockerfile
+++ b/docker/cue.Dockerfile
@@ -1,5 +1,5 @@
 FROM golang:1.25-bookworm
-ARG CUE_VERSION=0.15.0
+ARG CUE_VERSION=0.16.0
 
 RUN apt update && \
     apt install -y --no-install-recommends bash-completion && \