diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..0752c15f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+version: 2
+
+updates:
+  # Keeps the actions used by .github/workflows in step with their upstream
+  # releases. Without this, majors drift until a runner deprecation (such as the
+  # Node.js 20 removal) turns the drift into a warning on every run.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # One pull request for the whole set: these are updated together anyway, and
+    # a separate pull request per action would drown the queue.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci"
+    labels:
+      - Dependencies
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 533bdece..04e15188 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -25,14 +25,27 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Two actions below are deliberately held back from their newest release, both
+# because of the Node.js 20 deprecation:
+#
+# - pnpm/action-setup is pinned to v5, not v6. v6 rewrote the self-installer to
+#   shell out to `npm ci`, and our self-hosted Linux runner has no npm on PATH
+#   beyond the runner's own Node.js 24 externals — where it is broken. v5 is a
+#   Node.js 24 action too, and still bootstraps from a bundled pnpm, so it
+#   clears the deprecation without the new npm dependency. Move to v6 once that
+#   runner has a working npm.
+# - hendrikmuhs/ccache-action is pinned to an exact patch because its floating
+#   v1 / v1.2 tags still point at a Node.js 20 build. Float again once upstream
+#   moves them to >= v1.2.22.
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -41,18 +54,18 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       # Set up JDK and Android SDK only because we need weak-node-api, to build ferric-example and to run the linting
       # TODO: Remove this once we have a way to run linting without building the native code
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
         with:
           packages: tools platform-tools ndk;${{ env.NDK_VERSION }}
       - run: rustup target add x86_64-linux-android
@@ -79,9 +92,9 @@ jobs:
     runs-on: ${{ matrix.runner }}
     name: Unit tests (${{ matrix.runner }})
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -90,16 +103,16 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
         with:
           packages: tools platform-tools ndk;${{ env.NDK_VERSION }}
       - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim
@@ -118,9 +131,9 @@ jobs:
     runs-on: ${{ matrix.runner }}
     name: Weak Node-API tests (${{ matrix.runner }})
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -129,7 +142,7 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - run: pnpm install
@@ -147,9 +160,9 @@ jobs:
     name: Test app (iOS)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -158,16 +171,16 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
         with:
           packages: tools platform-tools ndk;${{ env.NDK_VERSION }}
       - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim
@@ -191,9 +204,9 @@ jobs:
     name: Test app (macOS)
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -202,11 +215,11 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
@@ -239,9 +252,9 @@ jobs:
     name: Test app (Android)
     runs-on: ubuntu-self-hosted
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -250,16 +263,16 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
         with:
           packages: tools platform-tools ndk;${{ env.NDK_VERSION }} cmake;${{ env.CMAKE_VERSION }}
       - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim
@@ -275,7 +288,7 @@ jobs:
           echo "REACT_NATIVE_OVERRIDE_HERMES_DIR=$REACT_NATIVE_OVERRIDE_HERMES_DIR" >> $GITHUB_ENV
         working-directory: apps/test-app
       # - name: Setup Android Emulator cache
-      #   uses: actions/cache@v4
+      #   uses: actions/cache@v6
       #   id: avd-cache
       #   with:
       #     path: |
@@ -320,7 +333,7 @@ jobs:
             kill $LOGCAT_PID || true
       - name: Upload device logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: emulator-logcat
           path: apps/test-app/emulator-logcat.txt
@@ -329,9 +342,9 @@ jobs:
     name: Test ferric Apple triplets
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -340,11 +353,11 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
@@ -363,7 +376,7 @@ jobs:
         run: lipo -info ferric_example.apple.node/*/libferric_example.framework/libferric_example > lipo-info.txt
         working-directory: packages/ferric-example
       - name: Upload lipo info
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: lipo-info
           path: packages/ferric-example/lipo-info.txt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd1414da..29ba7a4c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,9 @@ on:
 # refreshing the "Version Packages" pull request until someone approves. The
 # two jobs that must not overlap carry their own groups instead.
 
+# pnpm/action-setup is pinned to v5 and hendrikmuhs/ccache-action to an exact
+# patch, both for Node.js 20 deprecation reasons. See the note in check.yml.
+
 jobs:
   # changesets/action's sub-actions split the "what should happen?" decision out
   # of the doing, which is what lets only the publish half sit behind the "main"
@@ -35,9 +38,9 @@ jobs:
     outputs:
       mode: ${{ steps.select.outputs.mode }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -67,9 +70,9 @@ jobs:
       contents: write # the version branch
       pull-requests: write # the "Version Packages" pull request
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -94,9 +97,9 @@ jobs:
       contents: write # git tags and GitHub releases
       id-token: write # NPM trusted publishing
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/krypton
           cache: pnpm
@@ -105,16 +108,16 @@ jobs:
         with:
           clang-format: true
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1.2
+        uses: hendrikmuhs/ccache-action@v1.2.23
         with:
           key: ${{ github.job }}-${{ runner.os }}
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           java-version: "17"
           distribution: "temurin"
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
         with:
           packages: tools platform-tools ndk;${{ env.NDK_VERSION }}
       - run: rustup target add x86_64-linux-android aarch64-linux-android armv7-linux-androideabi i686-linux-android aarch64-apple-ios-sim