diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5310d22..671ec1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
 
@@ -74,7 +74,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
       - name: Run npm audit
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 882f2c0..77e9041 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install SDK
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: "1.22"
       - name: Run conformance
diff --git a/.github/workflows/console.yml b/.github/workflows/console.yml
index 8df79b7..d0533af 100644
--- a/.github/workflows/console.yml
+++ b/.github/workflows/console.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Build the SDK (console imports its dist via file:..)
diff --git a/.github/workflows/dep-audit.yml b/.github/workflows/dep-audit.yml
index 49bf8b6..d67134b 100644
--- a/.github/workflows/dep-audit.yml
+++ b/.github/workflows/dep-audit.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - uses: pypa/gh-action-pip-audit@v1.1.0
diff --git a/.github/workflows/hsm-nightly.yml b/.github/workflows/hsm-nightly.yml
index a441c49..b15c278 100644
--- a/.github/workflows/hsm-nightly.yml
+++ b/.github/workflows/hsm-nightly.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           role-to-assume: ${{ secrets.AWS_KMS_TEST_ROLE_ARN }}
           aws-region: us-east-1
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
       - run: npm ci
       - run: npx vitest run test/hsm-integration.test.ts
@@ -36,7 +36,7 @@ jobs:
           client-id: ${{ secrets.AZURE_KV_TEST_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
       - run: npm ci
       - run: npx vitest run test/hsm-integration.test.ts
@@ -51,7 +51,7 @@ jobs:
         with:
           workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
           service_account: ${{ secrets.GCP_KMS_TEST_SA }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
       - run: npm ci
       - run: npx vitest run test/hsm-integration.test.ts
@@ -70,7 +70,7 @@ jobs:
           export SOFTHSM2_CONF=$HOME/.softhsm/softhsm2.conf
           echo "directories.tokendir = $HOME/.softhsm/tokens" > $SOFTHSM2_CONF
           softhsm2-util --init-token --slot 0 --label pl-test --pin 1234 --so-pin 1234
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
       - run: npm ci
       - run: npx vitest run test/hsm-integration.test.ts
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index 6a64258..634572d 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Build the SDK (sub-packages depend on its dist)
diff --git a/.github/workflows/publish-python.yml b/.github/workflows/publish-python.yml
index 6169eac..f0244fa 100644
--- a/.github/workflows/publish-python.yml
+++ b/.github/workflows/publish-python.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9e10b74..72f65cd 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35c1ef2..90b2faf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
       - run: npm ci || npm install
       - name: TS build
@@ -29,7 +29,7 @@ jobs:
     needs: preflight
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -51,7 +51,7 @@ jobs:
     needs: preflight
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20", cache: npm }
       - run: npm ci && npm run build
       - name: Generate SBOM
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 175ef24..1d1b5b9 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with: { node-version: "20" }
       - run: npm ci
       # Produce the CycloneDX SBOM the checklist's G.1 check looks for. It is