diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 55c128b89..cf4e5b0ac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,3 +26,10 @@ updates:
       github-actions:
         patterns:
           - "*"
+    ignore:
+      # upload-artifact majors are release-path sensitive: its artifact-id output feeds the
+      # SignPath signing steps, which only execute on release publish — a bad bump breaks
+      # signing at the worst possible moment. Bumped manually alongside a validated signing
+      # run instead (#1653).
+      - dependency-name: "actions/upload-artifact"
+        update-types: ["version-update:semver-major"]
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dd445ff27..3587e432e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,12 +18,12 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Detect changed paths
         id: filter
         if: github.event_name != 'release'
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           # On push events, compare against the previous commit on this branch
           # (github.event.before). Without this, the action defaults to comparing
@@ -93,7 +93,7 @@ jobs:
 
       - name: Setup .NET 10.0
         if: steps.filter.outputs.code != 'false'
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
           cache: true
@@ -189,7 +189,7 @@ jobs:
       - name: Cache Darling pg-runtime.zip
         if: github.event_name == 'release'
         id: cache-pg-runtime
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: Darling/artifacts/pg-runtime.zip
           key: pg-runtime-${{ runner.os }}-${{ hashFiles('Darling/tools/fetch-pg-runtime.ps1') }}
@@ -210,6 +210,11 @@ jobs:
           # users at Setup.exe (Velopack); this ZIP is the explicit fallback.
           Compress-Archive -Path 'publish/Lite/*' -DestinationPath "releases/PerformanceMonitorLite-$version.zip" -Force
 
+      # upload-artifact is deliberately HELD at v6 (#1653): every signing step below consumes
+      # `steps.upload-*.outputs.artifact-id`, and v7 changes artifact archiving semantics (the
+      # `archive` parameter). The signing path only executes on `release: [published]`, so a broken
+      # bump surfaces at release time — bump only alongside a validated real signing run.
+      # Dependabot is configured to skip this major (see .github/dependabot.yml).
       - name: Upload Lite for signing
         if: github.event_name == 'release'
         id: upload-lite
@@ -420,7 +425,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       # Only do the expensive TimescaleDB work when Darling code changed — or when THIS workflow
       # changed, so a change to the gate itself is exercised by the gate (this is what makes the PR
@@ -430,7 +435,7 @@ jobs:
       - name: Detect changed paths
         id: filter
         if: github.event_name != 'release'
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           # On push, compare against the previous commit on this branch (mirrors the build job);
           # on pull_request, an empty base makes the action diff against the PR base branch.
@@ -443,7 +448,7 @@ jobs:
 
       - name: Setup .NET 10.0
         if: steps.filter.outputs.darling == 'true'
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
           cache: true
@@ -454,7 +459,7 @@ jobs:
       - name: Cache Darling pg-runtime.zip
         if: steps.filter.outputs.darling == 'true'
         id: cache-pg-runtime
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: Darling/artifacts/pg-runtime.zip
           key: pg-runtime-${{ runner.os }}-${{ hashFiles('Darling/tools/fetch-pg-runtime.ps1') }}
diff --git a/.github/workflows/check-version-bump.yml b/.github/workflows/check-version-bump.yml
index bca145ad6..226d267ba 100644
--- a/.github/workflows/check-version-bump.yml
+++ b/.github/workflows/check-version-bump.yml
@@ -10,7 +10,7 @@ jobs:
 
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       # Documentation-only PRs (e.g. a CHANGELOG correction) do not bump the
       # version. The workflow still runs so the required check reports a result
@@ -19,7 +19,7 @@ jobs:
       # any non-*.md file changed.
       - name: Detect non-documentation changes
         id: changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@v4
         with:
           filters: |
             code:
@@ -37,7 +37,7 @@ jobs:
 
       - name: Checkout main
         if: steps.changes.outputs.code == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           ref: main
           path: main-branch
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index c59b56b88..5c3f2787c 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -25,7 +25,7 @@ jobs:
       # Mapped to env so the step guard below can skip cleanly when the secret is absent.
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index f067b446a..0be8bc0b3 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       has_changes: ${{ steps.check.outputs.has_changes }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: dev
           fetch-depth: 0
@@ -38,12 +38,12 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: dev
 
       - name: Setup .NET 10.0
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
           cache: true
@@ -89,7 +89,7 @@ jobs:
       # branch; nightly and release runs share the assembled zip whenever the cache is visible.
       - name: Cache Darling pg-runtime.zip
         id: cache-pg-runtime
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: Darling/artifacts/pg-runtime.zip
           key: pg-runtime-${{ runner.os }}-${{ hashFiles('Darling/tools/fetch-pg-runtime.ps1') }}
@@ -196,12 +196,12 @@ jobs:
       # would be main). A manual dispatch tests the DISPATCHED ref — the only way to validate a
       # branch's gated-pg test changes before merge; the artifact-publishing build job stays
       # pinned to dev either way, so a branch dispatch can never ship branch binaries.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || 'dev' }}
 
       - name: Setup .NET 10.0
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
           cache: true
@@ -213,7 +213,7 @@ jobs:
       # release share one cache entry, so a warm cache means no download here.
       - name: Cache Darling pg-runtime.zip
         id: cache-pg-runtime
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: Darling/artifacts/pg-runtime.zip
           key: pg-runtime-${{ runner.os }}-${{ hashFiles('Darling/tools/fetch-pg-runtime.ps1') }}
diff --git a/.github/workflows/sql-validation.yml b/.github/workflows/sql-validation.yml
index 330c84862..42a4b9dfb 100644
--- a/.github/workflows/sql-validation.yml
+++ b/.github/workflows/sql-validation.yml
@@ -41,7 +41,7 @@ jobs:
           --health-retries 15
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install sqlcmd
         run: |