diff --git a/.github/workflows/docs-dispatch.yml b/.github/workflows/docs-dispatch.yml
index d01f7e3..f1c9e66 100644
--- a/.github/workflows/docs-dispatch.yml
+++ b/.github/workflows/docs-dispatch.yml
@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d480987..d622bd2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -23,10 +23,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "latest"
 
@@ -66,12 +66,12 @@ jobs:
           echo "::notice::Skipping SDK conformance check — TANGO_API_REPO_ACCESS_TOKEN not configured."
         fi
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       if: steps.gate.outputs.ready == 'true'
 
     - name: Checkout tango API repo (manifest source)
       if: steps.gate.outputs.ready == 'true'
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: makegov/tango
         path: tango-api
@@ -79,7 +79,7 @@ jobs:
 
     - name: Install uv
       if: steps.gate.outputs.ready == 'true'
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "latest"
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7bc21b1..5c7e6d4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,10 +10,10 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     
     - name: Install uv
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: 'latest'
     
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2593369..c961939 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,10 +20,10 @@ jobs:
       if: matrix.os == 'windows-latest'
       run: git config --global core.longpaths true
     
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     
     - name: Install uv
-      uses: astral-sh/setup-uv@v4
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "latest"
     
@@ -37,8 +37,8 @@ jobs:
       run: uv run pytest
     
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v5
       with:
-        file: ./coverage.xml
+        files: ./coverage.xml
         flags: unittests
         name: codecov-${{ matrix.os }}-py${{ matrix.python-version }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 685bcaa..16c86ea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### CI
+- Bumped GitHub Actions off the deprecated Node 20 runtime (forced off
+  2026-06-02): `actions/checkout` v4→v6, `astral-sh/setup-uv` v4→v8.1.0
+  (pinned exact — no floating `v8` major tag is published yet), and
+  `codecov/codecov-action` v3→v5 (with the renamed `files:` input).
+
 ## [1.1.1] - 2026-05-29
 
 ### Removed