diff --git a/.github/workflows/android-debug.yml b/.github/workflows/android-debug.yml
index c5f8911..f348f2b 100644
--- a/.github/workflows/android-debug.yml
+++ b/.github/workflows/android-debug.yml
@@ -29,7 +29,7 @@ jobs:
       CARGO_PROFILE_DEV_STRIP: symbols
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -46,25 +46,25 @@ jobs:
           git clone --depth 1 https://github.com/readest/tauri-plugin-webview-upgrade.git apps/readest-app/src-tauri/plugins/tauri-plugin-webview-upgrade
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 11.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: '17'
           cache: gradle
 
       - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Install Android SDK packages
         run: sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
@@ -297,7 +297,7 @@ jobs:
           echo "Verified arm64-v8a-only APK: $apk_path"
 
       - name: Upload Android arm64-v8a debug APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: readinfinity-android-arm64-v8a-debug-${{ github.sha }}
           path: ${{ steps.apk.outputs.path }}
diff --git a/.github/workflows/android-e2e.yml b/.github/workflows/android-e2e.yml
index ed4d6bd..c21fd10 100644
--- a/.github/workflows/android-e2e.yml
+++ b/.github/workflows/android-e2e.yml
@@ -46,7 +46,7 @@ jobs:
           cache: pnpm
 
       - name: setup Java
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: 'zulu'
           java-version: '17'
diff --git a/.github/workflows/android-stable-release.yml b/.github/workflows/android-stable-release.yml
index c653826..231a2d5 100644
--- a/.github/workflows/android-stable-release.yml
+++ b/.github/workflows/android-stable-release.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 120
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -48,25 +48,25 @@ jobs:
           git clone --depth 1 https://github.com/readest/tauri-plugin-webview-upgrade.git apps/readest-app/src-tauri/plugins/tauri-plugin-webview-upgrade
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 11.1.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: pnpm
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: '17'
           cache: gradle
 
       - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Install Android SDK packages
         run: sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
@@ -398,7 +398,7 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Upload all ABI build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: readinfinity-android-all-abi-release-${{ github.sha }}
           path: |
@@ -462,22 +462,22 @@ jobs:
           gh release upload "$RELEASE_TAG" latest.json release-notes.json --clobber
 
       - name: Attest arm64-v8a APK
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: apps/readest-app/${{ steps.apk.outputs.arm64_asset }}
 
       - name: Attest armeabi-v7a APK
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: apps/readest-app/${{ steps.apk.outputs.armv7_asset }}
 
       - name: Attest x86 APK
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: apps/readest-app/${{ steps.apk.outputs.x86_asset }}
 
       - name: Attest x86_64 APK
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: apps/readest-app/${{ steps.apk.outputs.x86_64_asset }}
 
@@ -506,7 +506,7 @@ jobs:
           cat "apps/readest-app/${{ steps.apk.outputs.x86_64_asset }}.sha256"
 
       - name: Upload all-ABI release metadata
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: readinfinity-all-abi-release-metadata-${{ github.sha }}
           path: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e096469..3596834 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -71,7 +71,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -100,6 +100,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           category: '/language:${{matrix.language}}'
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 6004fb8..49a9b8f 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -104,7 +104,7 @@ jobs:
 
       - name: setup Java (for Android build only)
         if: matrix.config.release == 'android'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: 'zulu'
           java-version: '17'
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index da2f67a..d2e675e 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24
-    - uses: cachix/cachix-action@f495f3ffa2f3810a92e5cc0abc2c5d6a2a07ec82
+    - uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866
       with:
         name: readest
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
diff --git a/.github/workflows/nix-update-inputs.yml b/.github/workflows/nix-update-inputs.yml
index 8640ac3..e32e26b 100644
--- a/.github/workflows/nix-update-inputs.yml
+++ b/.github/workflows/nix-update-inputs.yml
@@ -15,8 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:      
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-      - uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858
-      - uses: DeterminateSystems/update-flake-lock@6eeac1e86e13a9256682f930c4c7568acc43f047
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614
+      - uses: DeterminateSystems/update-flake-lock@01467157fe94fd33c160f7311a78689ceaad3ec4
         with:
           pr-title: "chore(nix): update flake inputs"
           pr-labels: |
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index e5ff024..bebdf9c 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -24,7 +24,7 @@ jobs:
       # skipPush is a cachix-action input, not an install-nix-action one. The
       # cache is public, so pulling needs no token at all; omitting authToken
       # keeps the push token out of PR-triggered builds entirely.
-      - uses: cachix/cachix-action@f495f3ffa2f3810a92e5cc0abc2c5d6a2a07ec82
+      - uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866
         with:
           name: readest
           skipPush: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 975f4af..2886e2f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -329,7 +329,7 @@ jobs:
 
       - name: setup Java (for Android build only)
         if: matrix.config.release == 'android'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: 'zulu'
           java-version: '17'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index be660e1..c701704 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -73,6 +73,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif