diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ca83ccd..702de98 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -50,11 +50,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Cached: `az bicep install` pulls the CLI from GitHub releases on every run otherwise,
       # which was ~20s of the job's total.
       - name: Cache Bicep CLI
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.azure/bin
           key: bicep-${{ runner.os }}
@@ -76,14 +76,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
       # NuGet cache — keyed on csproj + Directory.Packages.props, so a code-only
       # change still reuses the cache and skips the network restore.
       - name: Cache NuGet packages
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.nuget/packages
           key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'Directory.Packages.props') }}
@@ -114,7 +114,7 @@ jobs:
           cd publish
           zip -r ../webapp.zip . -q
       - name: Upload webapp artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: webapp
           path: webapp.zip
@@ -143,18 +143,18 @@ jobs:
       # github.event.before, and a depth-1 checkout does not contain that commit — the diff fails,
       # the guard falls through to "changed", and infra is applied on every push exactly as it was
       # before the guard existed.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       # Lands webapp.zip in the workspace root — the build job already packaged it, so this job
       # deploys the exact bytes that were tested rather than re-zipping a folder it just unpacked.
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: webapp
           path: .
       # OIDC federated identity — no client secrets stored in GitHub.
       # Federated credential subject: repo:punkouter26/PoRepoLineTracker:ref:refs/heads/master
-      - uses: azure/login@v2
+      - uses: azure/login@v3
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}
@@ -262,8 +262,8 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && inputs.deploy_infra
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: azure/login@v2
+      - uses: actions/checkout@v7
+      - uses: azure/login@v3
         with:
           client-id: ${{ vars.AZURE_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_TENANT_ID }}