diff --git a/.github/workflows/nfr.yml b/.github/workflows/nfr.yml
index 55cf6349..bb588f4e 100644
--- a/.github/workflows/nfr.yml
+++ b/.github/workflows/nfr.yml
@@ -83,13 +83,13 @@ jobs:
     if: always()
     steps:
       - name: Download head results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: nfr-head
           path: head/
 
       - name: Download base results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: nfr-base
           path: base/
diff --git a/.github/workflows/security-dependencies.yml b/.github/workflows/security-dependencies.yml
index 1db4ea62..af67d775 100644
--- a/.github/workflows/security-dependencies.yml
+++ b/.github/workflows/security-dependencies.yml
@@ -65,12 +65,12 @@ jobs:
       total_findings: ${{ steps.summary.outputs.total }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # ==================== Go Setup (if needed) ====================
       - name: Set up Go
         if: inputs.has_go && (inputs.scan_govulncheck || inputs.scan_trivy)
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -78,7 +78,7 @@ jobs:
       # ==================== Trivy ====================
       - name: Setup Trivy
         if: inputs.scan_trivy
-        uses: aquasecurity/setup-trivy@v0.2.3
+        uses: aquasecurity/setup-trivy@v0.2.5
         with:
           cache: true
           version: latest
@@ -149,7 +149,7 @@ jobs:
 
       - name: Attest SBOM
         if: inputs.scan_trivy && inputs.generate_sbom && github.event_name != 'pull_request' && hashFiles('sbom.json') != ''
-        uses: actions/attest-sbom@v2
+        uses: actions/attest-sbom@v3
         with:
           subject-path: 'sbom.json'
           sbom-path: 'sbom.json'
@@ -214,7 +214,7 @@ jobs:
           echo "| **Total** | **$TOTAL** |" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: dependency-scan-results
diff --git a/.github/workflows/security-detect.yml b/.github/workflows/security-detect.yml
index 99a3d270..421cfa4a 100644
--- a/.github/workflows/security-detect.yml
+++ b/.github/workflows/security-detect.yml
@@ -31,7 +31,7 @@ jobs:
       languages: ${{ steps.detect.outputs.languages }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: |
             go.mod
diff --git a/.github/workflows/security-gate.yml b/.github/workflows/security-gate.yml
index 4e424870..c7eff7e9 100644
--- a/.github/workflows/security-gate.yml
+++ b/.github/workflows/security-gate.yml
@@ -81,7 +81,7 @@ jobs:
       reason: ${{ steps.evaluate.outputs.reason }}
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: results
         continue-on-error: true
@@ -184,7 +184,7 @@ jobs:
 
       - name: PR Comment
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/security-sast-common.yml b/.github/workflows/security-sast-common.yml
index 68d861a2..c0bfef4e 100644
--- a/.github/workflows/security-sast-common.yml
+++ b/.github/workflows/security-sast-common.yml
@@ -35,7 +35,7 @@ jobs:
       medium: ${{ steps.scan.outputs.medium }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run Semgrep
         id: scan
@@ -94,7 +94,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: semgrep-results
diff --git a/.github/workflows/security-sast-go.yml b/.github/workflows/security-sast-go.yml
index b2fb1279..574f23bf 100644
--- a/.github/workflows/security-sast-go.yml
+++ b/.github/workflows/security-sast-go.yml
@@ -43,10 +43,10 @@ jobs:
       suppressed: ${{ steps.scan.outputs.suppressed }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -137,7 +137,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: gosec-results
diff --git a/.github/workflows/security-sast-python.yml b/.github/workflows/security-sast-python.yml
index 4368e50a..e35a0697 100644
--- a/.github/workflows/security-sast-python.yml
+++ b/.github/workflows/security-sast-python.yml
@@ -43,10 +43,10 @@ jobs:
       low: ${{ steps.scan.outputs.low }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 
@@ -136,7 +136,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: bandit-results
diff --git a/.github/workflows/security-secrets.yml b/.github/workflows/security-secrets.yml
index a3e65d6c..540a5589 100644
--- a/.github/workflows/security-secrets.yml
+++ b/.github/workflows/security-secrets.yml
@@ -55,14 +55,14 @@ jobs:
       errors: ${{ steps.summary.outputs.errors }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: ${{ inputs.scan_history && 0 || 50 }}
 
       # ==================== CKB Secret Scanner ====================
       - name: Set up Go (for CKB)
         if: inputs.scan_ckb
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
           cache: true
@@ -203,7 +203,7 @@ jobs:
           echo "| **Total** | **$TOTAL** |" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: secret-scan-results