diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3620280ce3e..606a5d914af 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -41,11 +41,19 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
-    open-pull-requests-limit: 10
+      interval: daily
     labels:
       - dependencies
     groups:
-      official-actions:
-        patterns:
-          - "actions/*"
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: rust-preview
+    schedule:
+      interval: daily
+    labels: [dependencies]
+    groups:
+      actions:
+        patterns: ["*"]
diff --git a/.github/workflows/asf-source-candidate.yml b/.github/workflows/asf-source-candidate.yml
index 5b7abe52650..86273befccb 100644
--- a/.github/workflows/asf-source-candidate.yml
+++ b/.github/workflows/asf-source-candidate.yml
@@ -31,7 +31,7 @@ concurrency:
   cancel-in-progress: false
 jobs:
   candidate:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
       RELEASE_VERSION: ${{ inputs.version }}
@@ -41,26 +41,32 @@ jobs:
         env:
           RELEASE_REF: ${{ github.ref }}
         run: test "$RELEASE_REF" = refs/heads/main
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
       - name: Update Rust
         run: rustup update stable --no-self-update
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+      - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
-          tool: just@1.59.0,cargo-nextest@0.9.149,cargo-deny
+          tool: cargo-binstall
+      - name: Install latest Rust tools
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cargo binstall --no-confirm --force cargo-binstall
+          cargo binstall --no-confirm --force just cargo-nextest cargo-deny
       - name: Install native dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y bubblewrap ripgrep pkg-config libx11-dev libxi-dev libxtst-dev libxext-dev
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Select npm
-        run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
+        run: npm install --global --no-audit --no-fund npm@latest
       - name: Create source candidate
         run: just source "$RELEASE_VERSION" "$GITHUB_SHA"
       - name: Extract exact candidate
@@ -84,7 +90,7 @@ jobs:
         run: |
           just website-setup
           just website-check
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: asf-source-candidate
           path: release/asf/*
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c7cfc7edaf..7e32593a1b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     # Allow cold compilation and Host fixtures that reserve multiple CPU slots.
     timeout-minutes: 180
     env:
@@ -42,12 +42,12 @@ jobs:
       # Cargo retains linked outputs in target; avoid another copy in mbx's store.
       MBX_CACHE_LINKS: "0"
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
           cache: npm
       # NSH headless rendering tests need Vulkan and Mesa software adapters,
       # as in third-party/nsh/.github/workflows/gpui.yml.
@@ -84,10 +84,16 @@ jobs:
           echo "$RUNNER_TEMP/mbx-bin" >> "$GITHUB_PATH"
           echo "$RUNNER_TEMP/mbx-data/mbx/bin" >> "$GITHUB_PATH"
           echo "key=rust-target-${RUNNER_OS}-${RUNNER_ARCH}-$(rustc -vV | sha256sum | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT"
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+      - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
-          tool: just@1.59.0,cargo-nextest@0.9.149,cargo-deny
-      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+          tool: cargo-binstall
+      - name: Install latest Rust tools
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cargo binstall --no-confirm --force cargo-binstall
+          cargo binstall --no-confirm --force just cargo-nextest cargo-deny
+      - uses: actions/cache/restore@v6
         id: cargo-cache
         with:
           path: |
@@ -97,7 +103,7 @@ jobs:
           restore-keys: cargo-${{ runner.os }}-
       - name: Restore compiled Rust cache
         id: rust-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@v6
         with:
           path: target
           key: ${{ steps.mbx.outputs.key }}-${{ hashFiles('Cargo.lock', 'third-party/termina/Cargo.lock') }}-${{ github.sha }}
@@ -105,7 +111,7 @@ jobs:
             ${{ steps.mbx.outputs.key }}-${{ hashFiles('Cargo.lock', 'third-party/termina/Cargo.lock') }}-
             ${{ steps.mbx.outputs.key }}-
       - name: Select npm
-        run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
+        run: npm install --global --no-audit --no-fund npm@latest
       - run: just setup
       - name: Verify Rust dependency inventory before compilation
         run: |
@@ -138,13 +144,13 @@ jobs:
       # Publish complete compiler outputs before any behavior tests can fail.
       - name: Save compiled Rust cache
         if: (github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/rust-preview'))) && steps.rust-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/save@v6
         with:
           path: target
           key: ${{ steps.rust-cache.outputs.cache-primary-key }}
       - name: Save Cargo downloads
         if: (github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/rust-preview'))) && steps.cargo-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/save@v6
         with:
           path: |
             ~/.cargo/registry
@@ -201,7 +207,7 @@ jobs:
   nsh-integration:
     needs: test
     if: ${{ always() && github.event_name == 'workflow_dispatch' && !cancelled() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     env:
       CARGO_BUILD_JOBS: "2"
@@ -209,7 +215,7 @@ jobs:
       CARGO_PROFILE_DEV_DEBUG: "0"
       CARGO_PROFILE_TEST_DEBUG: "0"
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Verify source revision
@@ -225,7 +231,7 @@ jobs:
         run: |
           rustup update stable --no-self-update
           echo "key=nsh-target-${RUNNER_OS}-${RUNNER_ARCH}-$(rustc -vV | sha256sum | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -234,7 +240,7 @@ jobs:
           restore-keys: nsh-cargo-${{ runner.os }}-
       - name: Restore NSH compiled cache
         id: nsh-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@v6
         with:
           path: ${{ env.CARGO_TARGET_DIR }}
           key: ${{ steps.rust.outputs.key }}-${{ hashFiles('third-party/nsh/Cargo.lock', 'third-party/nsh/crates/gpui/Cargo.lock') }}-${{ github.sha }}
@@ -334,7 +340,7 @@ jobs:
           if [ -d "$CARGO_TARGET_DIR" ]; then du -sh "$CARGO_TARGET_DIR"; fi
       - name: Save NSH compiled cache
         if: ${{ !cancelled() && steps.nsh-cache.outcome == 'success' && steps.nsh-cache.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/save@v6
         with:
           path: ${{ env.CARGO_TARGET_DIR }}
           key: ${{ steps.nsh-cache.outputs.cache-primary-key }}
diff --git a/.github/workflows/computer-use.yml b/.github/workflows/computer-use.yml
index 7b3781f7a0f..10150b348ba 100644
--- a/.github/workflows/computer-use.yml
+++ b/.github/workflows/computer-use.yml
@@ -48,18 +48,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [ubuntu-24.04, macos-26, windows-2025]
+        runner: [ubuntu-latest, macos-latest, windows-latest]
     env:
       CARGO_BUILD_JOBS: "2"
       CARGO_INCREMENTAL: "0"
       CARGO_PROFILE_DEV_DEBUG: "0"
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Update Rust
         run: rustup update stable --no-self-update
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/copilot-auto-review.yml b/.github/workflows/copilot-auto-review.yml
index a33f7e1de62..858a9a08c85 100644
--- a/.github/workflows/copilot-auto-review.yml
+++ b/.github/workflows/copilot-auto-review.yml
@@ -33,7 +33,7 @@ jobs:
       github.event.pull_request.draft == false &&
       !endsWith(github.event.pull_request.user.login, '[bot]') &&
       !contains(github.event.pull_request.labels.*.name, 'copilot-skip')
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index ea158bbb66a..e0c8b24a292 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -63,36 +63,42 @@ concurrency:
 
 jobs:
   rust-licenses:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
       - name: Update stable Rust for dependency resolution
         run: rustup update stable --no-self-update
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+      - uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
-          tool: cargo-deny@0.20.2
+          tool: cargo-binstall
+      - name: Install latest Rust tools
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cargo binstall --no-confirm --force cargo-binstall
+          cargo binstall --no-confirm --force cargo-deny
       - name: Check Rust licenses and dependency inventory
         run: node scripts/rust/dependencies.mjs check
 
   audit:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
           cache: npm
 
       - name: Install build dependencies
diff --git a/.github/workflows/issue-pr-lifecycle.yml b/.github/workflows/issue-pr-lifecycle.yml
index 9515e038219..a8d56fa155f 100644
--- a/.github/workflows/issue-pr-lifecycle.yml
+++ b/.github/workflows/issue-pr-lifecycle.yml
@@ -46,16 +46,16 @@ concurrency:
 jobs:
   lifecycle:
     if: github.repository == 'apache/maka'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
 
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9
         env:
           DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
         with:
diff --git a/.github/workflows/npm-publication.yml b/.github/workflows/npm-publication.yml
index d157725f614..e25c4c149c8 100644
--- a/.github/workflows/npm-publication.yml
+++ b/.github/workflows/npm-publication.yml
@@ -31,18 +31,18 @@ permissions:
 
 jobs:
   source:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
       version: ${{ steps.source.outputs.version }}
       build_id: ${{ steps.source.outputs.build_id }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
       - id: source
         name: Freeze one source archive for every platform
         run: |
@@ -54,7 +54,7 @@ jobs:
           appendFileSync(process.env.GITHUB_OUTPUT, 'version=' + version + '\n' +
             'build_id=' + process.env.GITHUB_RUN_ID + '.' + process.env.GITHUB_RUN_ATTEMPT + '\n');
           JS
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: native-preview-source
           path: release/asf/*
@@ -68,12 +68,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Computer Use's Swift bindings require the macOS 26 SDK.
-          - runner: macos-26
+          # Computer Use's Swift bindings use the current macOS SDK.
+          - runner: macos-latest
             target: darwin-arm64
-          - runner: ubuntu-24.04
+          - runner: ubuntu-latest
             target: linux-x64-gnu
-          - runner: windows-2025
+          - runner: windows-latest
             target: win32-x64
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
@@ -81,40 +81,48 @@ jobs:
       SOURCE_VERSION: ${{ needs.source.outputs.version }}
       BUILD_ID: ${{ needs.source.outputs.build_id }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
       - name: Update Rust
         run: rustup update stable --no-self-update
-      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+      - uses: actions/setup-python@v7
         with:
-          python-version: "3.15"
-      - name: Select the checked-in npm toolchain
+          python-version: "3.x"
+          check-latest: true
+      - name: Select latest npm
         shell: bash
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
+        run: npm install --global --ignore-scripts --no-audit --no-fund npm@latest
       - name: Install the Linux baseline linker
         if: runner.os == 'Linux'
-        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
-          version: 0.17.0
+          version: latest
       - name: Install native build dependencies
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
-          sudo apt-get install -y pkg-config libx11-dev libxi-dev libxtst-dev libxext-dev libxcb1-dev libxkbcommon-dev libxkbcommon-x11-dev libfontconfig1-dev libfreetype6-dev libwayland-dev libglib2.0-dev libclang-19-dev
-          echo 'LIBCLANG_PATH=/usr/lib/llvm-19/lib' >> "$GITHUB_ENV"
+          sudo apt-get install -y pkg-config libx11-dev libxi-dev libxtst-dev libxext-dev libxcb1-dev libxkbcommon-dev libxkbcommon-x11-dev libfontconfig1-dev libfreetype6-dev libwayland-dev libglib2.0-dev libclang-dev llvm-dev
+          echo "LIBCLANG_PATH=$(/usr/bin/llvm-config --libdir)" >> "$GITHUB_ENV"
       - name: Select libclang on macOS
         if: runner.os == 'macOS'
         run: echo "LIBCLANG_PATH=$(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib" >> "$GITHUB_ENV"
-      - name: Install cargo-zigbuild
+      - name: Bootstrap cargo-binstall
         if: runner.os == 'Linux'
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
-          tool: cargo-zigbuild@0.24.0
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+          tool: cargo-binstall
+      - name: Install latest cargo-zigbuild
+        if: runner.os == 'Linux'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cargo binstall --no-confirm --force cargo-binstall
+          cargo binstall --no-confirm --force cargo-zigbuild
+      - uses: actions/download-artifact@v8
         with:
           name: native-preview-source
           path: source
@@ -125,7 +133,7 @@ jobs:
           v8_key=$(node scripts/rust/build-v8.mjs --cache-key)
           echo "key=$v8_key" >> "$GITHUB_OUTPUT"
       - id: v8-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache/restore@v6
         with:
           path: target/v8/${{ steps.v8-key.outputs.key }}
           key: maka-v8-${{ matrix.target }}-${{ steps.v8-key.outputs.key }}
@@ -155,17 +163,17 @@ jobs:
           }
           JS
       # A later Maka build failure does not invalidate a completed V8 dependency.
-      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - uses: actions/cache/save@v6
         if: ${{ !cancelled() && steps.v8-cache.outputs.cache-hit != 'true' && hashFiles(format('target/v8/{0}/receipt.json', steps.v8-key.outputs.key)) != '' }}
         with:
           path: target/v8/${{ steps.v8-key.outputs.key }}
           key: maka-v8-${{ matrix.target }}-${{ steps.v8-key.outputs.key }}
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: native-preview-${{ matrix.target }}
           path: native-preview/*
           if-no-files-found: error
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         if: ${{ hashFiles('v8-preview/*.json') != '' }}
         with:
           name: v8-prebuilt-${{ matrix.target }}
@@ -174,18 +182,18 @@ jobs:
 
   prepare:
     needs: build
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
-      - name: Select the checked-in npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+          node-version: latest
+      - name: Select latest npm
+        run: npm install --global --ignore-scripts --no-audit --no-fund npm@latest
+      - uses: actions/download-artifact@v8
         with:
           pattern: native-preview-*
           merge-multiple: true
@@ -194,7 +202,7 @@ jobs:
         run: node scripts/rust/pack-launcher.mjs native-preview
       - name: Validate the complete release
         run: node scripts/rust/publish-cli.mjs native-preview
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: npm-release
           path: native-preview/*
@@ -205,20 +213,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [macos-15, ubuntu-24.04, windows-2025]
+        runner: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
-      - name: Select the checked-in npm toolchain
+          node-version: latest
+      - name: Select latest npm
         shell: bash
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        run: npm install --global --ignore-scripts --no-audit --no-fund npm@latest
+      - uses: actions/download-artifact@v8
         with:
           name: npm-release
           path: native-preview
@@ -232,22 +240,22 @@ jobs:
       group: npm-publication-rust-preview
       cancel-in-progress: false
     environment: npm-rust-preview
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
           registry-url: https://registry.npmjs.org
-      - name: Select the checked-in npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - name: Select latest npm
+        run: npm install --global --ignore-scripts --no-audit --no-fund npm@latest
+      - uses: actions/download-artifact@v8
         with:
           name: npm-release
           path: native-preview
diff --git a/.github/workflows/pr-effort-label.yml b/.github/workflows/pr-effort-label.yml
index ac6d32ec8d2..38b199c9300 100644
--- a/.github/workflows/pr-effort-label.yml
+++ b/.github/workflows/pr-effort-label.yml
@@ -46,7 +46,7 @@ concurrency:
 
 jobs:
   label:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
@@ -54,12 +54,12 @@ jobs:
       # the trusted default-branch commit rather than left to the event's
       # default: pull_request_review and friends resolve to refs/pull/N/merge,
       # and this job imports the checked-out script.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
 
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@v9
         env:
           DRY_RUN: ${{ inputs.dry_run || false }}
         with:
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 5a459ba63f5..6f74d0d700f 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -54,15 +54,15 @@ concurrency:
 jobs:
   validate:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
           cache: npm
           cache-dependency-path: website/package-lock.json
       - run: npm --prefix website ci
@@ -71,18 +71,18 @@ jobs:
   publish:
     # Release tags publish nothing; only release candidates are staged.
     if: github.event_name != 'pull_request' && (github.event_name != 'push' || github.ref_type == 'branch' || contains(github.ref_name, '-rc'))
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@v7
         with:
-          node-version: "26"
+          node-version: latest
           cache: npm
           cache-dependency-path: website/package-lock.json