diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19a31e0..11bff55 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@1.89.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy,rustfmt
       - name: Install cargo-audit 0.22.2
@@ -35,7 +35,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Validate PowerShell installer syntax
@@ -122,7 +122,7 @@ jobs:
           } finally {
             Remove-Item -Recurse -Force -ErrorAction SilentlyContinue $testRoot
           }
-      - uses: dtolnay/rust-toolchain@1.89.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy,rustfmt
       - run: cargo check --tests --locked
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d1945c..00b0531 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -32,7 +32,7 @@ jobs:
           grep -Fq "## [$version] - " CHANGELOG.md
           git fetch origin main:refs/remotes/origin/main
           git merge-base --is-ancestor "$GITHUB_SHA" origin/main
-      - uses: dtolnay/rust-toolchain@1.89.0
+      - uses: dtolnay/rust-toolchain@1.100.0
         with:
           components: clippy,rustfmt
       - name: Install cargo-audit 0.22.2
@@ -63,7 +63,7 @@ jobs:
             source: target/aarch64-unknown-linux-musl/release/opencode-ssh-image-paste
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Validate PowerShell installer syntax
@@ -87,7 +87,7 @@ jobs:
         if: runner.os == 'Windows'
         shell: pwsh
         run: ./tests/bootstrap.Tests.ps1
-      - uses: dtolnay/rust-toolchain@1.89.0
+      - uses: dtolnay/rust-toolchain@1.100.0
       - run: cargo test --locked
       - name: Install Linux musl build tools
         if: runner.os == 'Linux'
@@ -154,7 +154,7 @@ jobs:
       - name: Prepare release asset
         shell: bash
         run: cp "${{ matrix.source }}" "${{ matrix.asset }}"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.asset }}
           path: ${{ matrix.asset }}
@@ -168,10 +168,10 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true
@@ -180,7 +180,7 @@ jobs:
       - name: Generate checksums
         working-directory: dist
         run: sha256sum opencode-ssh-image-paste-* bootstrap.ps1 > SHA256SUMS
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@v3
         with:
           generate_release_notes: true
           files: |