diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index beaaefa..d592fb2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,8 +12,8 @@ jobs:
   core:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
           cache: true
@@ -27,8 +27,8 @@ jobs:
   web:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm
@@ -40,8 +40,8 @@ jobs:
   macos:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - run: ./scripts/build.sh
@@ -49,8 +49,8 @@ jobs:
   apple-tunnel:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - run: ./scripts/build.sh --all
@@ -59,8 +59,8 @@ jobs:
   linux-vpn:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Build disposable signed-distribution lab image
@@ -70,18 +70,18 @@ jobs:
   browser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm
       - run: npm ci
       - run: npx playwright install --with-deps chromium
       - run: npm run test:browser --workspace @meshway/web
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: browser-failure-evidence
@@ -89,11 +89,11 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '8.0.x'
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - run: dotnet build apps/windows/Meshway/Meshway.csproj -c Release
@@ -105,7 +105,7 @@ jobs:
       - run: ./scripts/windows-tun-lab.ps1 -Package dist/Meshway-win-x64
       - if: ${{ !cancelled() && steps.package.outcome == 'success' }}
         run: ./scripts/windows-firewall-lab.ps1 -Package dist/Meshway-win-x64
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: windows-runtime-evidence
@@ -117,15 +117,15 @@ jobs:
   android:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '17'
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@v4
         with:
           packages: ''
       - run: sdkmanager "platforms;android-35" "build-tools;35.0.0" "ndk;27.2.12479018"
diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index 26aedab..3846508 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -18,7 +18,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Validate destination and tag
         id: release
         env:
@@ -31,20 +31,20 @@ jobs:
           fi
           image="ghcr.io/$(printf '%s' "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')"
           printf 'version=%s\nimage=%s\n' "$version" "$image" >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - run: go test -race ./... -count=1 -timeout=180s
-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: .
           file: deploy/Dockerfile
@@ -77,11 +77,11 @@ jobs:
             docker run --rm --platform "linux/$architecture" "$IMAGE:$VERSION-$architecture" version
             docker save "$IMAGE:$VERSION-$architecture" | gzip > "container-downloads/meshway-container-linux-$architecture.tar.gz"
           done
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: portable-container-images
           path: container-downloads
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: container-publication-evidence
           path: container-manifest.txt
diff --git a/.github/workflows/contribution.yml b/.github/workflows/contribution.yml
index deb4109..abc8c01 100644
--- a/.github/workflows/contribution.yml
+++ b/.github/workflows/contribution.yml
@@ -12,8 +12,8 @@ jobs:
   formatting:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Check Go formatting
@@ -29,8 +29,8 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@v7
+      - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
           comment-summary-in-pr: never
diff --git a/.github/workflows/linux-packages.yml b/.github/workflows/linux-packages.yml
index cbb76b2..d78cd44 100644
--- a/.github/workflows/linux-packages.yml
+++ b/.github/workflows/linux-packages.yml
@@ -34,10 +34,10 @@ jobs:
       MESHWAY_DIST_DIR: .tools/linux-package-lab/dist
       MESHWAY_RELEASE_DIR: .tools/linux-package-lab/packages
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Build native core and real Debian/RPM packages
@@ -56,7 +56,7 @@ jobs:
           rpm_package=$(find "$MESHWAY_RELEASE_DIR" -maxdepth 1 -name "*.$RPM_ARCH.rpm" -print -quit)
           test -n "$rpm_package"
           python3 scripts/package-install-lab.py --format rpm --image fedora:44 --package "$rpm_package" --version "$PACKAGE_VERSION" --output ".tools/linux-package-lab/rpm-$PACKAGE_ARCH.json"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: linux-packages-${{ matrix.go_arch }}
diff --git a/.github/workflows/macos-utun-headers.yml b/.github/workflows/macos-utun-headers.yml
index d62f50b..fce075c 100644
--- a/.github/workflows/macos-utun-headers.yml
+++ b/.github/workflows/macos-utun-headers.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: macos-14
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Build opt-in isolated real kernel test
@@ -26,7 +26,7 @@ jobs:
       - name: Capture only fixed private UDP header metadata
         run: |
           sudo -n /usr/bin/env GITHUB_ACTIONS=true MESHWAY_DISPOSABLE_MACOS_VM=1 MESHWAY_UTUN_HEADER_LAB=1 MESHWAY_UTUN_HEADER_OUTPUT="$PWD/.tools/utun-headers" .tools/utun-headers/macvpn.test -test.run '^TestHostedUTUNKernelUDPMetadata$' -test.v -test.timeout=120s
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: macos-utun-header-metadata
diff --git a/.github/workflows/macos-utun-loopback.yml b/.github/workflows/macos-utun-loopback.yml
index 94ca472..df98b40 100644
--- a/.github/workflows/macos-utun-loopback.yml
+++ b/.github/workflows/macos-utun-loopback.yml
@@ -16,10 +16,10 @@ jobs:
       MESHWAY_DISPOSABLE_MACOS_VM: '1'
       MESHWAY_TESTED_REF: ${{ inputs.ref }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Build production helper
@@ -28,7 +28,7 @@ jobs:
           go build -buildvcs=false -trimpath -o .tools/macos-utun-lab/meshway ./cmd/meshway
       - name: Actual full helper with local authenticated exit and DNS
         run: python3 scripts/macos-utun-loopback-lab.py
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: macos-utun-loopback-runtime
diff --git a/.github/workflows/macos-utun.yml b/.github/workflows/macos-utun.yml
index b9c39f0..959969c 100644
--- a/.github/workflows/macos-utun.yml
+++ b/.github/workflows/macos-utun.yml
@@ -23,10 +23,10 @@ jobs:
     env:
       MESHWAY_DISPOSABLE_MACOS_VM: '1'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Build and publish only the temporary client public peer ID
@@ -34,7 +34,7 @@ jobs:
           mkdir -p .tools/macos-utun-lab
           go build -buildvcs=false -trimpath -ldflags='-s -w' -o .tools/macos-utun-lab/meshway ./cmd/meshway
           python3 scripts/macos-utun-lab.py --prepare
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: macos-utun-client-peer
           path: .tools/macos-utun-lab/client-peer.json
@@ -52,7 +52,7 @@ jobs:
           if [ -x .tools/macos-utun-lab/meshway ]; then
             sudo -n .tools/macos-utun-lab/meshway vpn stop --config "$PWD/.tools/macos-utun-lab/config.json" || true
           fi
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: macos-utun-runtime-proof
diff --git a/.github/workflows/native-installers.yml b/.github/workflows/native-installers.yml
index 3a68e41..bfe552a 100644
--- a/.github/workflows/native-installers.yml
+++ b/.github/workflows/native-installers.yml
@@ -22,13 +22,13 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '8.0.x'
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
       - name: Build existing native payloads
@@ -69,7 +69,7 @@ jobs:
           if ($LASTEXITCODE -ne 0 -or $release -ne 'true') { throw 'Only the existing private draft release may receive staged installers.' }
           gh release upload $env:DRAFT_TAG .tools/release/installers/Meshway-setup-x64.exe .tools/release/installers/Meshway-setup-arm64.exe artifacts/windows-installer-validation.json --clobber
           if ($LASTEXITCODE -ne 0) { throw 'Private draft installer upload failed.' }
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: native-windows-installers
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 3524b0d..98b0cbc 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -17,17 +17,17 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: npm
       - run: npm ci
       - run: npm run build --workspace @meshway/web -- --base /meshway/
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@v6
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: apps/web/dist
       - name: Publish static website
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf43b0f..06dd226 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,14 +25,14 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.27.2'
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
       - run: npm ci
@@ -44,7 +44,7 @@ jobs:
         env:
           RELEASE_TAG: ${{ inputs.tag }}
         run: MESHWAY_RELEASE_VERSION="${RELEASE_TAG#v}" ./scripts/release.sh
-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
       - name: Package Linux installers