diff --git a/.github/workflows/code-metrics.yml b/.github/workflows/code-metrics.yml
index b5a28df..9e4fbe2 100644
--- a/.github/workflows/code-metrics.yml
+++ b/.github/workflows/code-metrics.yml
@@ -45,7 +45,7 @@ jobs:
           dir: ${{ './' }}
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v8.1.0
+        uses: peter-evans/create-pull-request@v8.1.1
         if: ${{ steps.dotnet-code-metrics.outputs.updated-metrics }} == 'true'
         with:
           title: '${{ steps.dotnet-code-metrics.outputs.summary-title }}'
diff --git a/.github/workflows/squad-heartbeat.yml b/.github/workflows/squad-heartbeat.yml
index b6c3d28..317c0f9 100644
--- a/.github/workflows/squad-heartbeat.yml
+++ b/.github/workflows/squad-heartbeat.yml
@@ -26,7 +26,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Ralph — Check for squad work
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -248,7 +248,7 @@ jobs:
       # Copilot auto-assign step (uses PAT if available)
       - name: Ralph — Assign @copilot issues
         if: success()
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/squad-issue-assign.yml b/.github/workflows/squad-issue-assign.yml
index 18bc56b..a31a59c 100644
--- a/.github/workflows/squad-issue-assign.yml
+++ b/.github/workflows/squad-issue-assign.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Identify assigned member and trigger work
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -116,7 +116,7 @@ jobs:
       # Separate step: assign @copilot using PAT (required for coding agent)
       - name: Assign @copilot coding agent
         if: github.event.label.name == 'squad:copilot'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN }}
           script: |
diff --git a/.github/workflows/squad-label-enforce.yml b/.github/workflows/squad-label-enforce.yml
index bb123fa..33d57e7 100644
--- a/.github/workflows/squad-label-enforce.yml
+++ b/.github/workflows/squad-label-enforce.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Enforce mutual exclusivity
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/squad-test.yml b/.github/workflows/squad-test.yml
index 28f260f..60fe692 100644
--- a/.github/workflows/squad-test.yml
+++ b/.github/workflows/squad-test.yml
@@ -513,7 +513,7 @@ jobs:
           path: coverage-output
 
       - name: Publish to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         if: always()
         with:
           fail_ci_if_error: false
diff --git a/.github/workflows/squad-triage.yml b/.github/workflows/squad-triage.yml
index 2bbf638..c7c9424 100644
--- a/.github/workflows/squad-triage.yml
+++ b/.github/workflows/squad-triage.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Triage issue via Lead agent
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/sync-squad-labels.yml b/.github/workflows/sync-squad-labels.yml
index abba77f6..59943e4 100644
--- a/.github/workflows/sync-squad-labels.yml
+++ b/.github/workflows/sync-squad-labels.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Parse roster and sync labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');