diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index deb781de..84b439ce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,9 +30,9 @@ jobs:
     name: frontend
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -84,9 +84,9 @@ jobs:
     name: go
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -194,9 +194,9 @@ jobs:
     env:
       SHARDS: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -232,9 +232,9 @@ jobs:
       matrix:
         distro: [minimal, developer, managed, full]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -266,9 +266,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -306,8 +306,8 @@ jobs:
     outputs:
       sets: ${{ steps.list.outputs.sets }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -324,8 +324,8 @@ jobs:
       matrix:
         set: ${{ fromJSON(needs.omit-tag-sets.outputs.sets) }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -357,11 +357,11 @@ jobs:
     name: plugin manifest drift
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -407,11 +407,11 @@ jobs:
     name: action taxonomy drift
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/custom-build.yml b/.github/workflows/custom-build.yml
index 0ca78732..184f6a76 100644
--- a/.github/workflows/custom-build.yml
+++ b/.github/workflows/custom-build.yml
@@ -63,12 +63,12 @@ jobs:
     outputs:
       distro: ${{ steps.resolve.outputs.distro }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -97,13 +97,13 @@ jobs:
           npm ci
           SBO_DISTRO_PROOF="$GITHUB_WORKSPACE/resolved/web-proof.json" npm run build
           test -f dist/index.html
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: custom-resolved
           path: resolved/
           retention-days: 3
           if-no-files-found: error
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: custom-web-dist
           path: web/dist/
@@ -123,12 +123,12 @@ jobs:
           - goos: windows
             goarch: arm64
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with:
           name: custom-web-dist
           path: web/dist/
@@ -157,7 +157,7 @@ jobs:
             case "$f" in *.txt|*.json) continue ;; esac
             go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 -mode binary -format openvex "$f" > "$f.vex.json"
           done
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: custom-staged-${{ matrix.goos }}-${{ matrix.goarch }}
           path: staged/
@@ -171,17 +171,17 @@ jobs:
     env:
       DISTRO: ${{ needs.resolve.outputs.distro }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with:
           pattern: custom-staged-*
           path: in/
           merge-multiple: true
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with:
           name: custom-resolved
           path: resolved/
@@ -229,7 +229,7 @@ jobs:
           echo "  slsa-github-generator generic provenance over SHA256SUMS"
           echo "and sign with the vendor key, never this ephemeral one."
           echo "This workflow has no id-token permission and runs neither."
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: custom-bundle
           path: bundle/
diff --git a/.github/workflows/demo-org-images.yml b/.github/workflows/demo-org-images.yml
old mode 100755
new mode 100644
index 878c3736..444253ab
--- a/.github/workflows/demo-org-images.yml
+++ b/.github/workflows/demo-org-images.yml
@@ -93,7 +93,7 @@ jobs:
       tag: ${{ steps.r.outputs.tag }}
       version: ${{ steps.r.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false
@@ -146,7 +146,7 @@ jobs:
       TAG: ${{ needs.resolve.outputs.tag }}
       VERSION: ${{ needs.resolve.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.resolve.outputs.sha }}
           persist-credentials: false
@@ -161,10 +161,10 @@ jobs:
           echo "BUILD_CTX=$ctx" >> "$GITHUB_ENV"
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to the enterprise registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.ENTERPRISE_REGISTRY }}
           username: ${{ secrets.ENTERPRISE_REGISTRY_USERNAME }}
@@ -180,7 +180,7 @@ jobs:
 
       - name: Build and push
         id: push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         env:
           DOCKER_BUILD_RECORD_UPLOAD: 'false'
         with:
@@ -234,7 +234,7 @@ jobs:
       TAG: ${{ needs.resolve.outputs.tag }}
       VERSION: ${{ needs.resolve.outputs.version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.resolve.outputs.sha }}
           persist-credentials: false
@@ -267,10 +267,10 @@ jobs:
           "$dir/grype" version
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build (loaded locally, not pushed)
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         env:
           DOCKER_BUILD_RECORD_UPLOAD: 'false'
         with:
@@ -298,7 +298,7 @@ jobs:
 
       - name: Upload SBOMs + scan report
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: demo-sbom-observer-mcpgw
           path: sbom/
@@ -306,7 +306,7 @@ jobs:
           if-no-files-found: warn
 
       - name: Log in to the registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.ENTERPRISE_REGISTRY }}
           username: ${{ secrets.ENTERPRISE_REGISTRY_USERNAME }}
@@ -379,7 +379,7 @@ jobs:
       version: ${{ steps.copy.outputs.version }}
       digest: ${{ steps.copy.outputs.digest }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ needs.resolve.outputs.sha }}
           persist-credentials: false
@@ -445,7 +445,7 @@ jobs:
 
       - name: Upload SBOMs + scan reports
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: demo-sbom-agentgateway
           path: sbom/
@@ -453,7 +453,7 @@ jobs:
           if-no-files-found: warn
 
       - name: Log in to the registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.ENTERPRISE_REGISTRY }}
           username: ${{ secrets.ENTERPRISE_REGISTRY_USERNAME }}
diff --git a/.github/workflows/distro-staging.yml b/.github/workflows/distro-staging.yml
index e8fe2306..70920795 100644
--- a/.github/workflows/distro-staging.yml
+++ b/.github/workflows/distro-staging.yml
@@ -80,12 +80,12 @@ jobs:
       matrix:
         distro: [minimal, developer, managed, full]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: 'npm'
@@ -105,13 +105,13 @@ jobs:
           SBO_DISTRO_PROOF="$GITHUB_WORKSPACE/web-proof/web-proof.json" npm run build
           test -f dist/index.html
           test -f "$GITHUB_WORKSPACE/web-proof/web-proof.modules.json"
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: web-proof-${{ matrix.distro }}
           path: web-proof/
           retention-days: 3
           if-no-files-found: error
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: web-dist-${{ matrix.distro }}
           path: web/dist/
@@ -132,12 +132,12 @@ jobs:
           - goos: windows
             goarch: arm64
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with:
           name: web-dist-${{ matrix.distro }}
           path: web/dist/
@@ -168,7 +168,7 @@ jobs:
             case "$f" in *.txt|*.json) continue ;; esac
             go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 -mode binary -format openvex "$f" > "$f.vex.json"
           done
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: staged-${{ matrix.distro }}-${{ matrix.goos }}-${{ matrix.goarch }}
           path: staged/
@@ -191,8 +191,8 @@ jobs:
       matrix:
         image: [full, core]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -214,7 +214,7 @@ jobs:
           got="$(go version -m staged/observer-org-in-image-${{ matrix.image }} | awk '$1=="build" && $2 ~ /^-tags=/ {sub(/^-tags=/,"",$2); print $2}')"
           echo "image tags: ${got:-none}; catalog: ${want:-none}"
           [ "$got" = "$want" ]
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: staged-observer-org-${{ matrix.image }}
           path: staged/
@@ -231,12 +231,12 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with:
           pattern: staged-*
           path: in/
@@ -285,7 +285,7 @@ jobs:
           echo "  cosign sign-blob --yes --bundle <file>.cosign.bundle <file>"
           echo "  slsa-github-generator generic provenance over SHA256SUMS"
           echo "This workflow has no id-token permission and runs neither."
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: release-shape
           path: shape/
diff --git a/.github/workflows/kafka-conformance.yml b/.github/workflows/kafka-conformance.yml
index d4525471..4b69bf80 100644
--- a/.github/workflows/kafka-conformance.yml
+++ b/.github/workflows/kafka-conformance.yml
@@ -61,9 +61,9 @@ jobs:
       CGO_ENABLED: '0'
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: true