diff --git a/.github/workflows/JS_build_test_publish.yml b/.github/workflows/JS_build_test_publish.yml
index 43666272..4146cc91 100644
--- a/.github/workflows/JS_build_test_publish.yml
+++ b/.github/workflows/JS_build_test_publish.yml
@@ -97,7 +97,7 @@ jobs:
     name: "[${{ matrix.settings.target }}] Build & Test"
     runs-on: ${{ matrix.settings.host }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -113,7 +113,7 @@ jobs:
         if: ${{ matrix.settings.target == 'x86_64-pc-windows-msvc' }}
         run: npm install -g corepack --force
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         if: ${{ !matrix.settings.docker }}
         with:
           cache: yarn
@@ -127,7 +127,7 @@ jobs:
           toolchain: stable
           targets: ${{ matrix.settings.target }}
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -153,7 +153,7 @@ jobs:
         run: yarn install
         working-directory: ./js/optify-config
       - name: Setup node x86
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         if: matrix.settings.target == 'i686-pc-windows-msvc'
         with:
           architecture: x86
@@ -173,7 +173,7 @@ jobs:
         shell: bash
         working-directory: ./js/optify-config
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bindings-${{ matrix.settings.target }}
           path: ./js/optify-config/${{ env.APP_NAME }}.*.node
@@ -183,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
     name: "[FreeBSD] Build"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -194,7 +194,7 @@ jobs:
           shared-key: freebsd-rust
       - name: "Build & Test"
         id: build
-        uses: cross-platform-actions/action@v0.29.0
+        uses: cross-platform-actions/action@v1.0.0
         env:
           DEBUG: napi:*
           RUSTUP_IO_THREADS: 1
@@ -234,7 +234,7 @@ jobs:
             rm -rf target
             rm -rf .yarn/cache
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bindings-freebsd
           path: ./js/optify-config/${{ env.APP_NAME }}.*.node
@@ -256,7 +256,7 @@ jobs:
           - '20'
     runs-on: ${{ matrix.settings.host }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -272,7 +272,7 @@ jobs:
         if: ${{ matrix.settings.target == 'x86_64-pc-windows-msvc' }}
         run: npm install -g corepack --force
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           architecture: x64
           cache: yarn
@@ -283,7 +283,7 @@ jobs:
           yarn install
         working-directory: ./js/optify-config
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: bindings-${{ matrix.settings.target }}
           path: ./js/optify-config
@@ -307,7 +307,7 @@ jobs:
           - '20'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -319,7 +319,7 @@ jobs:
       - name: Install corepack
         run: npm install -g corepack
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           cache: yarn
           cache-dependency-path: ./js/optify-config/yarn.lock
@@ -333,7 +333,7 @@ jobs:
           yarn build:ts
         working-directory: ./js/optify-config
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: bindings-x86_64-unknown-linux-gnu
           path: ./js/optify-config
@@ -351,7 +351,7 @@ jobs:
           - '20'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -361,7 +361,7 @@ jobs:
           cache-on-failure: true
           shared-key: linux-aarch64-gnu-rust
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: bindings-aarch64-unknown-linux-gnu
           path: ./js/optify-config
@@ -378,7 +378,7 @@ jobs:
           yarn build:ts
         working-directory: ./js/optify-config
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
       - run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
@@ -400,7 +400,7 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -410,7 +410,7 @@ jobs:
           cache-on-failure: true
           shared-key: linux-aarch64-musl-rust
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: bindings-aarch64-unknown-linux-musl
           path: ./js/optify-config
@@ -428,7 +428,7 @@ jobs:
           yarn build:ts
         working-directory: ./js/optify-config
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: arm64
       - run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
@@ -451,7 +451,7 @@ jobs:
       - build
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -463,7 +463,7 @@ jobs:
       - name: Install corepack
         run: npm install -g corepack
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           cache: yarn
           cache-dependency-path: ./js/optify-config/yarn.lock
@@ -472,12 +472,12 @@ jobs:
         run: yarn install
         working-directory: ./js/optify-config
       - name: Download macOS x64 artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: bindings-x86_64-apple-darwin
           path: ./js/optify-config/artifacts
       - name: Download macOS arm64 artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: bindings-aarch64-apple-darwin
           path: ./js/optify-config/artifacts
@@ -491,7 +491,7 @@ jobs:
         shell: bash
         working-directory: ./js/optify-config
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bindings-universal-apple-darwin
           path: ./js/optify-config/${{ env.APP_NAME }}.*.node
@@ -508,7 +508,7 @@ jobs:
       - test-linux-aarch64-musl-binding
       - universal-macOS
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -520,7 +520,7 @@ jobs:
       - name: Install corepack
         run: npm install -g corepack
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           cache: yarn
           cache-dependency-path: ./js/optify-config/yarn.lock
@@ -529,7 +529,7 @@ jobs:
         run: yarn install
         working-directory: ./js/optify-config
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: ./js/optify-config/artifacts
       - name: Move artifacts
diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index 144ff1e2..ca4bd87d 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -55,7 +55,7 @@ jobs:
       matrix:
         os: ${{ fromJson(needs.setup.outputs.matrix) }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     # Rust
     - name: "[Rust] Setup cache"
@@ -149,7 +149,7 @@ jobs:
     - name: "[JS] Install corepack"
       run: npm install -g corepack
     - name: Setup node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         cache: yarn
         cache-dependency-path: ./js/optify-config/yarn.lock
@@ -173,7 +173,7 @@ jobs:
       working-directory: ./js/optify-config
 
     # Python
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
       name: "[Python] Setup"
       with:
         cache: pip
diff --git a/.github/workflows/python_publish.yml b/.github/workflows/python_publish.yml
index 3be7b00f..f99b91bb 100644
--- a/.github/workflows/python_publish.yml
+++ b/.github/workflows/python_publish.yml
@@ -39,16 +39,19 @@ jobs:
           - runner: ubuntu-22.04
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
+      # manylinux builds run in a container and can leave root-owned files in
+      # python/optify/target, which breaks rust-cache save with tar permission errors.
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: |
             python/optify
             rust/optify
+          cache-targets: false
           cache-on-failure: true
           shared-key: ${{ matrix.platform.runner }}-${{ matrix.platform.target }}-rust
       - name: Build wheels
@@ -59,8 +62,16 @@ jobs:
           sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
           manylinux: auto
           working-directory: python/optify
+      # maturin-action enables sccache inside the manylinux container, but the
+      # rust-cache post step runs on the host and will fail `cargo metadata` if
+      # RUSTC_WRAPPER still points to the container-only sccache binary.
+      - name: "[Rust] Clear sccache wrapper"
+        shell: bash
+        run: |
+          echo "RUSTC_WRAPPER=" >> "$GITHUB_ENV"
+          echo "SCCACHE_GHA_ENABLED=" >> "$GITHUB_ENV"
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: python/optify/dist
@@ -74,8 +85,8 @@ jobs:
           - runner: windows-latest
             target: x64
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
           architecture: ${{ matrix.platform.target }}
@@ -95,7 +106,7 @@ jobs:
           sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
           working-directory: python/optify
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: python/optify/dist
@@ -109,8 +120,8 @@ jobs:
           - runner: macos-latest
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: 3.x
       - name: "[Rust] Setup cache"
@@ -129,7 +140,7 @@ jobs:
           sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
           working-directory: python/optify
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: python/optify/dist
@@ -137,7 +148,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.draft == false || github.event_name != 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "[Rust] Setup cache"
         uses: Swatinem/rust-cache@v2
         with:
@@ -153,7 +164,7 @@ jobs:
           args: --out dist
           working-directory: python/optify
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: python/optify/dist
@@ -170,11 +181,13 @@ jobs:
       contents: write
       # Used to generate artifact attestation
       attestations: write
+      # Required by actions/attest when creating artifact metadata records.
+      artifact-metadata: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v8
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest@v4
         with:
           subject-path: 'wheels-*/*'
       - name: "Publish to PyPI"
diff --git a/.github/workflows/ruby_build_test.yml b/.github/workflows/ruby_build_test.yml
index e3f27795..f84bd3b7 100644
--- a/.github/workflows/ruby_build_test.yml
+++ b/.github/workflows/ruby_build_test.yml
@@ -73,7 +73,7 @@ jobs:
       contents: write
     
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     # Ruby
     # Gem: optify-from_hash
@@ -139,7 +139,7 @@ jobs:
       contents: write
     
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     # setup-ruby also runs `bundle install`.
     # It uses the Ruby version from .ruby-version.
@@ -221,7 +221,7 @@ jobs:
         - arm64-darwin
         - x86_64-linux
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: "[Rust] Setup cache"
       uses: Swatinem/rust-cache@v2
@@ -306,7 +306,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: "[Rust] Setup cache"
       uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/vsc_extension-build_test.yml b/.github/workflows/vsc_extension-build_test.yml
index 576d581f..5f3a6ecc 100644
--- a/.github/workflows/vsc_extension-build_test.yml
+++ b/.github/workflows/vsc_extension-build_test.yml
@@ -45,10 +45,10 @@ jobs:
       matrix:
         settings: ${{ fromJson(needs.setup.outputs.matrix) }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Setup node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         cache: npm
         cache-dependency-path: ./vscode/extension/package-lock.json