diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index 4e3846aa3bc8..c5437a9d05ed 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -13,7 +13,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: Add to Docs
-        uses: actions/add-to-project@v0.4.0
+        uses: actions/add-to-project@v1.0.2
         with:
           project-url: https://github.com/orgs/pulumi/projects/79
           github-token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_GHA_MARKETING }}
diff --git a/.github/workflows/automerge-workflow.yml b/.github/workflows/automerge-workflow.yml
index 40c3c4173e5d..fd848d1a0e66 100644
--- a/.github/workflows/automerge-workflow.yml
+++ b/.github/workflows/automerge-workflow.yml
@@ -23,7 +23,7 @@ jobs:
           UPDATE_LABELS: automation/update
           UPDATE_METHOD: rebase
         name: Automerge
-        uses: pascalgn/automerge-action@v0.16.3
+        uses: pascalgn/automerge-action@v0.16.4
   notify:
     if: failure()
     name: Send slack notification
diff --git a/.github/workflows/bucket-cleanup-testing.yml b/.github/workflows/bucket-cleanup-testing.yml
index ba43efb94c0a..8f5c978caea7 100644
--- a/.github/workflows/bucket-cleanup-testing.yml
+++ b/.github/workflows/bucket-cleanup-testing.yml
@@ -19,14 +19,14 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::571684982431:role/ContinuousDelivery
           role-session-name: docs-deploy
diff --git a/.github/workflows/bucket-cleanup.yml b/.github/workflows/bucket-cleanup.yml
index 2f3bda9520df..fbd2c1110c9f 100644
--- a/.github/workflows/bucket-cleanup.yml
+++ b/.github/workflows/bucket-cleanup.yml
@@ -18,18 +18,18 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: 1.25.x
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::388588623842:role/ContinuousDelivery
           role-session-name: docs-cleanup
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index 2add20f42591..1be2baa65deb 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -25,23 +25,23 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: 1.25.x
 
-      - uses: peaceiris/actions-hugo@v2
+      - uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::388588623842:role/ContinuousDelivery
           role-session-name: docs-deploy
@@ -49,7 +49,7 @@ jobs:
           aws-region: us-west-2
 
       - name: Install Pulumi CLI
-        uses: pulumi/actions@v4
+        uses: pulumi/actions@v6
 
       - name: Build and deploy
         run: make ci_push
@@ -66,13 +66,13 @@ jobs:
           NODE_OPTIONS: "--max_old_space_size=8192"
 
       - name: Archive test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: browser-test-results
           path: cypress/videos
 
       - name: Archive bucket metadata
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: origin-bucket-metadata
           path: origin-bucket-metadata.json
diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index 3d8f033660c1..5e3d009c6145 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -16,13 +16,13 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install Node
         uses: actions/setup-node@v6
         with:
           node-version: '24.x'
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
diff --git a/.github/workflows/check-search-urls.yml b/.github/workflows/check-search-urls.yml
index f74c851cff76..3c1f6344ec99 100644
--- a/.github/workflows/check-search-urls.yml
+++ b/.github/workflows/check-search-urls.yml
@@ -17,14 +17,14 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Node
         uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
-      - uses: peaceiris/actions-hugo@v2
+      - uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index ffcda2ac690a..d8055ca6f6b6 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/customer-managed-workflow-agent-cli.yml b/.github/workflows/customer-managed-workflow-agent-cli.yml
index a3d904480a99..c006241acdc1 100644
--- a/.github/workflows/customer-managed-workflow-agent-cli.yml
+++ b/.github/workflows/customer-managed-workflow-agent-cli.yml
@@ -20,7 +20,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
       - name: set the customer-managed-workflow-agent version
         run: |
           echo "CMWA_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
@@ -43,7 +43,7 @@ jobs:
         run: |
           echo "CMWA_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
         with:
           path: docs
       - name: Update latest version
diff --git a/.github/workflows/esc-cli.yml b/.github/workflows/esc-cli.yml
index ae21bac6bf7a..8465a6f44d66 100644
--- a/.github/workflows/esc-cli.yml
+++ b/.github/workflows/esc-cli.yml
@@ -20,7 +20,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: set the esc version
         run: |
           echo "ESC_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
@@ -43,11 +43,11 @@ jobs:
         run: |
           echo "ESC_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
       - name: checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: docs
       - name: checkout esc repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: pulumi/esc
           path: esc
@@ -62,7 +62,7 @@ jobs:
           repo: pulumi/esc
           binaries-location: esc
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
diff --git a/.github/workflows/label-dependabot.yml b/.github/workflows/label-dependabot.yml
index 3f3414a0fe8d..3e452ef45342 100644
--- a/.github/workflows/label-dependabot.yml
+++ b/.github/workflows/label-dependabot.yml
@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Label and triage Dependabot PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             // Get PR details - either from event payload or workflow input
diff --git a/.github/workflows/pr-closed.yml b/.github/workflows/pr-closed.yml
index 0ba588777edf..26fb10b95255 100644
--- a/.github/workflows/pr-closed.yml
+++ b/.github/workflows/pr-closed.yml
@@ -19,18 +19,18 @@ jobs:
       - name: Fetch secrets from ESC
         id: esc-secrets
         uses: pulumi/esc-action@v1
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: 1.25.x
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::571684982431:role/ContinuousDelivery
           role-session-name: docs-cleanup
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 7f0580cb04c6..e85e46d00f5e 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -21,19 +21,19 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
-      - uses: peaceiris/actions-hugo@v2
+      - uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::571684982431:role/ContinuousDelivery
           role-session-name: docs-deploy
@@ -41,7 +41,7 @@ jobs:
           aws-region: us-west-2
 
       - name: Install Pulumi CLI
-        uses: pulumi/actions@v4
+        uses: pulumi/actions@v6
 
       - name: Build and deploy
         run: make ci_pull_request
@@ -59,13 +59,13 @@ jobs:
           NODE_OPTIONS: "--max_old_space_size=8192"
 
       - name: Archive test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: browser-test-results
           path: cypress/videos
 
       - name: Archive bucket metadata
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: origin-bucket-metadata
           path: origin-bucket-metadata.json
diff --git a/.github/workflows/pulumi-cli-dev-version.yml b/.github/workflows/pulumi-cli-dev-version.yml
index b6f7902b0304..2df5f7fbe556 100644
--- a/.github/workflows/pulumi-cli-dev-version.yml
+++ b/.github/workflows/pulumi-cli-dev-version.yml
@@ -21,7 +21,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
       - name: pull-request
         uses: repo-sync/pull-request@v2
         with:
@@ -38,7 +38,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
       - name: Update latest version
         run: |
           echo -n "${{ github.event.client_payload.dev_version }}" > ./static/latest-dev-version
diff --git a/.github/workflows/pulumi-cli.yml b/.github/workflows/pulumi-cli.yml
index 1d743f9b6220..de563cd89724 100644
--- a/.github/workflows/pulumi-cli.yml
+++ b/.github/workflows/pulumi-cli.yml
@@ -21,7 +21,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: set the pulumi version
         run: |
           echo "PULUMI_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
@@ -44,11 +44,11 @@ jobs:
         run: |
           echo "PULUMI_VERSION=${{ github.event.client_payload.ref }}" >> $GITHUB_ENV
       - name: checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: docs
       - name: checkout pulumi repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: pulumi/pulumi
           path: pulumi
@@ -62,11 +62,11 @@ jobs:
         with:
           pulumi-version: ${{ env.PULUMI_VERSION }}
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.goversion }}
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
@@ -75,13 +75,13 @@ jobs:
         with:
           node-version: ${{matrix.nodeversion}}
       - name: Install python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{matrix.pythonversion}}
       - name: Install Pipenv
         run: pip3 install pipenv
       - name: Install dotnet
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{matrix.dotnetverson}}
       - run: make ensure
diff --git a/.github/workflows/scheduled-test.yml b/.github/workflows/scheduled-test.yml
index abd1a75afaf7..d83277d9b3be 100644
--- a/.github/workflows/scheduled-test.yml
+++ b/.github/workflows/scheduled-test.yml
@@ -55,46 +55,46 @@ jobs:
           node-version: ${{ matrix.node-version }}
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
 
       - name: Install Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: ${{ matrix.java-version }}
 
       - name: Install DotNet
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ matrix.dotnet-version }}
 
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: "0.154.5"
           extended: true
 
       - name: Install Pulumi
-        uses: pulumi/actions@v4
+        uses: pulumi/actions@v6
         with:
           pulumi-version: latest
 
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Fetch master branch
         if: github.ref != 'refs/heads/master'
         run: git fetch origin master:master
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ env.AWS_REGION }}
@@ -104,7 +104,7 @@ jobs:
           role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }}
 
       - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
diff --git a/.github/workflows/scheduled-upgrade-programs.yml b/.github/workflows/scheduled-upgrade-programs.yml
index edecbeaacc22..e1a8371bddb1 100644
--- a/.github/workflows/scheduled-upgrade-programs.yml
+++ b/.github/workflows/scheduled-upgrade-programs.yml
@@ -51,42 +51,42 @@ jobs:
           node-version: ${{ matrix.node-version }}
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
 
       - name: Install Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: ${{ matrix.java-version }}
 
       - name: Install DotNet
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ matrix.dotnet-version }}
 
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v2
+        uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: "0.154.5"
           extended: true
 
       - name: Install Pulumi
-        uses: pulumi/actions@v4
+        uses: pulumi/actions@v6
 
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ env.AWS_REGION }}
@@ -99,7 +99,7 @@ jobs:
         run: make upgrade-programs test-programs
 
       - name: Create a pull request
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v8
         with:
           branch: examples/upgrade
           author: Pulumi Bot <bot@pulumi.com>
diff --git a/.github/workflows/scheduled-upstream-sync.yaml b/.github/workflows/scheduled-upstream-sync.yaml
index bd66524c6692..2e60bf741ee8 100644
--- a/.github/workflows/scheduled-upstream-sync.yaml
+++ b/.github/workflows/scheduled-upstream-sync.yaml
@@ -17,7 +17,7 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
       - name: Checkout target repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
         with:
           ref: master
           token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
diff --git a/.github/workflows/testing-build-and-deploy.yml b/.github/workflows/testing-build-and-deploy.yml
index 13f6a4fbf77c..2e1ef5c442b3 100644
--- a/.github/workflows/testing-build-and-deploy.yml
+++ b/.github/workflows/testing-build-and-deploy.yml
@@ -19,23 +19,23 @@ jobs:
         id: esc-secrets
         uses: pulumi/esc-action@v1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         with:
           node-version: '24.x'
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: 1.25.x
 
-      - uses: peaceiris/actions-hugo@v2
+      - uses: peaceiris/actions-hugo@v3
         with:
           hugo-version: '0.154.5'
           extended: true
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           role-to-assume: arn:aws:iam::571684982431:role/ContinuousDelivery
           role-session-name: docs-deploy
@@ -43,7 +43,7 @@ jobs:
           aws-region: us-west-2
 
       - name: Install Pulumi CLI
-        uses: pulumi/actions@v4
+        uses: pulumi/actions@v6
 
       - name: Build and deploy
         run: make ci_push
@@ -60,13 +60,13 @@ jobs:
           NODE_OPTIONS: "--max_old_space_size=8192"
 
       - name: Archive test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: browser-test-results
           path: cypress/videos
 
       - name: Archive bucket metadata
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: origin-bucket-metadata
           path: origin-bucket-metadata.json
diff --git a/.github/workflows/update-search-index.yml b/.github/workflows/update-search-index.yml
index ba7ce0da34e8..bb5f39d5b45d 100644
--- a/.github/workflows/update-search-index.yml
+++ b/.github/workflows/update-search-index.yml
@@ -19,7 +19,7 @@ jobs:
           node-version: '24.x'
 
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}