diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b88cb22..fd2a2b5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,18 +14,27 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '17'
-      - uses: gradle/actions/setup-gradle@v4
+      # `cache-provider: basic` is load-bearing, not a tuning knob. v6 moved the default caching
+      # implementation into `gradle-actions-caching`, a proprietary component governed by Gradle's
+      # commercial Terms of Use (https://blog.gradle.org/github-actions-for-gradle-v6); 'basic' is
+      # the open-source GitHub-Actions-cache implementation and keeps this repo off those terms.
+      # Don't drop this line to "take the default" — that silently opts into the commercial
+      # component. (v5 was the last fully-MIT line but is dead: v5.0.2, 2026-02, no security
+      # updates since.)
+      - uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-provider: basic
       - name: Unit tests
         run: ./gradlew --no-daemon testDebugUnitTest
       - name: Build debug APK
         run: ./gradlew --no-daemon :app:assembleDebug
       - name: Upload test APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pulseloop-debug-apk
           path: app/build/outputs/apk/debug/*.apk
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f28c063..a51a017 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Parse version from tag
         id: ver
@@ -39,12 +39,16 @@ jobs:
           echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
           echo "Building versionName=$NAME versionCode=$CODE prerelease=$PRERELEASE"
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '17'
 
-      - uses: gradle/actions/setup-gradle@v4
+      # cache-provider: basic — see the note in ci.yml. Keeps caching on the open-source
+      # implementation rather than v6's default commercial `gradle-actions-caching`.
+      - uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-provider: basic
 
       - name: Decode release keystore
         env:
@@ -93,7 +97,7 @@ jobs:
           ls -la dist
 
       - name: Create / update release and attach APKs
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: PulseLoop ${{ steps.ver.outputs.name }} (${{ steps.ver.outputs.code }})