diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f45b5e..5806e0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
         os: [windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
@@ -79,7 +79,7 @@ jobs:
         run: cargo test --doc --workspace --all-features
       - name: Test summary
         if: always()
-        uses: mikepenz/action-junit-report@v5
+        uses: mikepenz/action-junit-report@v6
         with:
           report_paths: target/nextest/ci/junit.xml
           annotate_only: true
@@ -94,11 +94,11 @@ jobs:
     name: linux verify (Docker + libfprint)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # The image builds libfprint v1.94.10 from source; the gha cache avoids rebuilding it every
       # run. docker-compose.yml names `fprintd-dev`, so every `run` below picks this up.
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
@@ -110,7 +110,7 @@ jobs:
       # volume is empty each run, so sccache (167 MiB) carries the 109 third-party crate compilations
       # between runs. Keyed on the lockfile and the image; either moving invalidates the cache.
       # See docker/docker-compose.ci.yml.
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: .sccache
           key: sccache-linux-${{ hashFiles('Cargo.lock', 'docker/Dockerfile') }}
@@ -153,7 +153,7 @@ jobs:
     name: systemd unit (Alias takes the seat)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Verify the unit against real systemd
@@ -167,7 +167,7 @@ jobs:
       # the 1.82 floor is the one under test.
       RUSTUP_TOOLCHAIN: "1.82"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.82
       - uses: Swatinem/rust-cache@v2
       # The Linux-only crates are absent: they declare 1.85 and would fail here. Their floor is
@@ -181,7 +181,7 @@ jobs:
     name: publish-check (the registry's rules)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       # publish-check dry-runs `cargo publish --workspace`, which builds the shim crate; its
@@ -195,7 +195,7 @@ jobs:
     name: supply chain (advisories, licences, bans, sources)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check
@@ -204,8 +204,8 @@ jobs:
     name: reuse lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: fsfe/reuse-action@v5
+      - uses: actions/checkout@v7
+      - uses: fsfe/reuse-action@v6
 
   mutants:
     name: mutants (the diff)
@@ -215,7 +215,7 @@ jobs:
     # Bounded: a large diff reports nothing rather than holding a runner. The finding is advisory.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # `git diff origin/<base>...HEAD` needs the base branch and the merge base
       - uses: dtolnay/rust-toolchain@stable
@@ -235,7 +235,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: llvm-tools-preview
@@ -247,7 +247,7 @@ jobs:
         run: >
           cargo llvm-cov nextest --all-features --lcov --output-path lcov.info
           -p fprint-core -p fprint-fp3 -p fprint-bozorth3 -p fprint-mindtct -p fprint-backend-native
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: coverage-lcov
           path: lcov.info
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 136839d..456bd9a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,12 +44,12 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: initialize CodeQL
-        uses: github/codeql-action/init@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-extended
       - name: analyze
-        uses: github/codeql-action/analyze@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 3118341..619400a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -32,13 +32,13 @@ jobs:
     name: build the book and the api reference
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
         with:
           tool: mdbook
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@v6
       # `cargo doc --workspace` documents the two C-linking crates (fprintd, fprint-backend-libfprint),
       # so the distro libfprint headers and libclang must be present for libfprint-sys bindgen.
       - name: Refresh the package index
@@ -57,7 +57,7 @@ jobs:
         run: cp -r docs/book _site
       - name: Place the API reference at /api
         run: cp -r target/doc _site/api
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: _site
 
@@ -70,4 +70,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
index c95961e..7e7748a 100644
--- a/.github/workflows/scheduled.yml
+++ b/.github/workflows/scheduled.yml
@@ -24,7 +24,7 @@ jobs:
     name: new advisories on unchanged code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check advisories
@@ -42,7 +42,7 @@ jobs:
       # the beta toolchain is used.
       RUSTUP_TOOLCHAIN: beta
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@beta
       - uses: Swatinem/rust-cache@v2
       # `RUSTFLAGS: -D warnings` is absent, unlike ci.yml: a new lint firing on beta is not a