diff --git a/.github/workflows/release-mcp.yml b/.github/workflows/release-mcp.yml
index b7f208b..a61ec6c 100644
--- a/.github/workflows/release-mcp.yml
+++ b/.github/workflows/release-mcp.yml
@@ -80,12 +80,12 @@ jobs:
       # instead of setup-uv so we don't pull in a project venv resolution we
       # don't use.
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.14"
 
       - name: Install Node.js (for mcpb CLI)
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 9712b8a..4fc387f 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -60,4 +60,4 @@ jobs:
     if: github.event_name == 'pull_request'
     steps:
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5