diff --git a/.github/workflows/binary-size.yml b/.github/workflows/binary-size.yml
index 2743b4ce8..8c31fb200 100644
--- a/.github/workflows/binary-size.yml
+++ b/.github/workflows/binary-size.yml
@@ -37,7 +37,7 @@ jobs:
       actions: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -55,7 +55,7 @@ jobs:
           cargo-llvm-lines@${{ env.CARGO_LLVM_LINES_VERSION }}
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
@@ -73,7 +73,7 @@ jobs:
         run: python3 scripts/ci/measure_binary_size.py --out-dir size-out
 
       - name: Upload size artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: size-metrics
           path: size-out/
@@ -175,7 +175,7 @@ jobs:
       # github-action-benchmark deploys the gh-pages site after auto-push.
       deployments: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -193,7 +193,7 @@ jobs:
           cargo-llvm-lines@${{ env.CARGO_LLVM_LINES_VERSION }}
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
 
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
@@ -212,7 +212,7 @@ jobs:
 
       # This artifact is the comparison baseline for PR runs.
       - name: Upload size artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: size-metrics
           path: size-out/
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index a45dfbdc8..2129a2b90 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index abd935c09..73483c7ea 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -76,7 +76,7 @@ jobs:
             packages: -p whatsapp-rust
             features: --features bench-harness
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -118,7 +118,7 @@ jobs:
       # the cache key: it hits while the package is valid and misses the moment
       # the runner image bumps glibc.
       - name: Cache the libc6-dbg package
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/libc6-dbg
           key: libc6-dbg-${{ runner.arch }}-${{ steps.libc6.outputs.version }}
@@ -249,7 +249,7 @@ jobs:
           CHATSTATE_TTL_SECS: "3"
         options: --log-driver none
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -291,7 +291,7 @@ jobs:
       # the cache key: it hits while the package is valid and misses the moment
       # the runner image bumps glibc.
       - name: Cache the libc6-dbg package
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/libc6-dbg
           key: libc6-dbg-${{ runner.arch }}-${{ steps.libc6.outputs.version }}
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 77ef46806..ee1e28ff2 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -34,7 +34,7 @@ jobs:
         options: --log-driver none
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@master
@@ -42,7 +42,7 @@ jobs:
           toolchain: nightly-2026-06-16
 
       - name: Cache install-action tools
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.install-action
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 437cc1807..21ab4a41a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -48,7 +48,7 @@ jobs:
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - id: meta
         uses: docker/metadata-action@v6
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index c4c0deb5a..eced48de0 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -52,7 +52,7 @@ jobs:
           --log-opt max-file=1
           --log-opt compress=false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: dtolnay/rust-toolchain@master
@@ -63,7 +63,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -94,7 +94,7 @@ jobs:
         run: scripts/ci/nextest_timed.sh e2e -p e2e-tests
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-e2e
           path: ${{ runner.temp }}/test-timings
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c362a3360..32019201f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,7 +42,7 @@ jobs:
     name: Format Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check Bartender image pins
         run: scripts/ci/sync-bartender-image.sh --check
       - uses: dtolnay/rust-toolchain@master
@@ -66,7 +66,7 @@ jobs:
       # This job never pushes, and the codegen shells out to `git fetch` against
       # a different repository; the checkout token has no business being left in
       # .git/config for that.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@master
@@ -76,14 +76,14 @@ jobs:
       # RUSTC_WRAPPER is set workspace-wide, so cargo needs sccache on PATH even
       # in a job this small.
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       - run: cargo run -p whatspec-codegen -- --check
 
   clippy:
     name: Clippy Linter
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
@@ -96,7 +96,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }}
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -111,7 +111,7 @@ jobs:
     name: Build & Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reclaim unused Android SDK space
         run: |
           df -h /
@@ -130,7 +130,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -159,7 +159,7 @@ jobs:
         run: scripts/ci/nextest_timed.sh workspace --workspace --exclude e2e-tests
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-build-and-test
           path: ${{ runner.temp }}/test-timings
@@ -187,7 +187,7 @@ jobs:
     # set, and paying that on the workflow's most-read job put it on the
     # critical path for nothing. Here it runs beside everything else.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
@@ -196,7 +196,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       - name: Cache Rust build (registry + target)
         uses: Swatinem/rust-cache@v2
         with:
@@ -221,7 +221,7 @@ jobs:
           exit "$status"
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-waproto-serde
           path: ${{ runner.temp }}/test-timings
@@ -237,7 +237,7 @@ jobs:
     # webrtc/opus tree compiles once and is cached (sccache), so the steady-state cost is the
     # workspace recompile with voip on, not the deps. The heavy relay e2e tests stay out of `--lib`.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reclaim unused Android SDK space
         run: |
           df -h /
@@ -255,7 +255,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -295,7 +295,7 @@ jobs:
           exit "$status"
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-all-features
           path: ${{ runner.temp }}/test-timings
@@ -311,7 +311,7 @@ jobs:
       # rustdoc, never by clippy or rustc, so they need their own gate.
       RUSTDOCFLAGS: "-D warnings"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Reclaim unused Android SDK space
         run: |
           df -h /
@@ -328,7 +328,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }}
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -351,7 +351,7 @@ jobs:
     outputs:
       crates: ${{ steps.crates.outputs.crates }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: crates
         run: echo "crates=$(scripts/ci/feature_matrix_crates.sh)" >> "$GITHUB_OUTPUT"
 
@@ -373,7 +373,7 @@ jobs:
       matrix:
         crate: ${{ fromJSON(needs.feature-matrix-crates.outputs.crates) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # No Android SDK reclaim here, unlike the three jobs that build the whole
       # workspace. A runner starts this leg with 87G free and one crate's
       # `check` comes nowhere near it, so the `rm -rf` bought 10G nothing asked
@@ -396,7 +396,7 @@ jobs:
         with:
           tool: cargo-hack
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -425,11 +425,11 @@ jobs:
       RUSTFLAGS: ""
       NEXTEST_PROFILE: ci
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       # Pinned rather than `@stable`: this version is the workspace MSRV
       # (`rust-version` in the root Cargo.toml). To raise the floor, bump both
       # together — a floating `stable` would silently let the declared MSRV rot.
-      - uses: dtolnay/rust-toolchain@1.94.1
+      - uses: dtolnay/rust-toolchain@1.100.0
       # The pre-built nextest binary is toolchain-independent — it drives this
       # MSRV cargo the same way it drives the nightly one.
       - name: Install protoc and cargo-nextest
@@ -437,7 +437,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }},cargo-nextest
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.
@@ -478,7 +478,7 @@ jobs:
           -p whatsapp-rust-sqlite-storage -p whatsapp-rust-tokio-transport
       - name: Publish test timings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-timings-msrv
           path: ${{ runner.temp }}/test-timings
diff --git a/.github/workflows/miri.yml b/.github/workflows/miri.yml
index 1b26cbc96..7130020bb 100644
--- a/.github/workflows/miri.yml
+++ b/.github/workflows/miri.yml
@@ -78,7 +78,7 @@ jobs:
             cache-key: libsignal-address
             args: -p wacore-libsignal --lib address
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0007670e6..a85f35054 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       tag: ${{ steps.version.outputs.tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Extract and validate version
         id: version
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -75,7 +75,7 @@ jobs:
           tool: cargo-release@0.25.20
 
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       - uses: Swatinem/rust-cache@v2
         with:
           cache-targets: "false"
@@ -90,7 +90,7 @@ jobs:
     needs: [preflight, publish]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/signal-durability-nightly.yml b/.github/workflows/signal-durability-nightly.yml
index 7b1b55182..8865788e1 100644
--- a/.github/workflows/signal-durability-nightly.yml
+++ b/.github/workflows/signal-durability-nightly.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Reclaim unused Android SDK space
@@ -54,7 +54,7 @@ jobs:
         with:
           tool: protoc@${{ env.PROTOC_VERSION }}
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba
       - name: Cache Rust build (registry + target)
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
         with:
@@ -74,7 +74,7 @@ jobs:
           --ignored --exact --nocapture
       - name: Preserve failed SQLite fixture
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: signal-durability-sqlite-${{ github.run_id }}
           path: /tmp/whatsapp-rust-signal-durability-*.db*
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 645f467db..05c81b89b 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -30,7 +30,7 @@ jobs:
     name: Cargo Deny
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
@@ -51,7 +51,7 @@ jobs:
     # not to block the PR.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
@@ -108,7 +108,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Upload the full semver-checks log
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: semver-checks-log
           path: semver.log
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index 603701df6..643725656 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -30,13 +30,13 @@ jobs:
     name: Build whatsapp-rust (wasm32, release)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: nightly-2026-06-16
           targets: wasm32-unknown-unknown
       - name: Setup sccache
-        uses: mozilla-actions/sccache-action@v0.0.10
+        uses: mozilla-actions/sccache-action@v0.0.11
       # Cache the target dir too: sccache can't cache proc-macros, build scripts
       # or bins (linker-output crate types), and those recompile every run.
       # Swatinem restores them; sccache still fills in after a Cargo.lock change.