diff --git a/.github/workflows/cdn-upload.yaml b/.github/workflows/cdn-upload.yaml
index 9bc6834..dab1463 100644
--- a/.github/workflows/cdn-upload.yaml
+++ b/.github/workflows/cdn-upload.yaml
@@ -47,13 +47,13 @@ jobs:
     steps:
       - name: Download build artifact
         if: inputs.artifact_name != ''
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact_name }}
           path: ${{ inputs.dist_dir }}
 
       - name: Upload assets to Azure Blob Storage
-        uses: azure/CLI@v2
+        uses: azure/cli@v3
         env:
           SAS_TOKEN: ${{ secrets.CDN_SAS_TOKEN }}
           CDN_ACCOUNT_NAME: ${{ inputs.cdn_account_name }}
diff --git a/.github/workflows/oci-build.yaml b/.github/workflows/oci-build.yaml
index aa4ceb9..ae61fb6 100644
--- a/.github/workflows/oci-build.yaml
+++ b/.github/workflows/oci-build.yaml
@@ -85,7 +85,6 @@ on:
 
 env:
   REGISTRY: ghcr.io
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
   build:
@@ -104,7 +103,7 @@ jobs:
       actions: read              # Required by codeql-action/upload-sarif on private repos
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -245,7 +244,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ github.repository }}/${{ inputs.image_name }}:${{ steps.version.outputs.next }}-rc.${{ steps.version.outputs.ts }}.${{ steps.version.outputs.short }}
 
       # ── Sign with Cosign (keyless / Sigstore) ────────────────
-      - uses: sigstore/cosign-installer@v3
+      - uses: sigstore/cosign-installer@v4
         if: steps.changes.outputs.changed == 'true' && github.event_name != 'pull_request'
 
       - name: Sign image