diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 46fbabfe2..16ad09aca 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -16,7 +16,7 @@ jobs:
       android: ${{ steps.filter.outputs.android }}
     steps:
       - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -94,7 +94,7 @@ jobs:
         run: bash tool/dev/build.sh android
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: DPIP-Android-Release
           path: build/app/outputs/flutter-apk/*.apk
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 1d245f3d7..c1bfce532 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -28,7 +28,7 @@ jobs:
       ios: ${{ steps.filter.outputs.ios }}
     steps:
       - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -66,9 +66,16 @@ jobs:
           # DerivedData is never consulted for packages and caching it stored
           # nothing. Losing this directory is what makes a launch print fifteen
           # "Fetching from … (cached)" lines and cost 19-32 s.
+          #
+          # The DerivedData line is release.yml's, whose xcodebuild archive does
+          # clone there; nothing in this job writes it. It is listed so the two
+          # lists match line for line: a cache entry's version is a hash of these
+          # paths, and only an identical list lets this job restore the entry
+          # main saved instead of storing a fresh ~880 MB copy per pull request.
           path: |
             ~/Library/Caches/org.swift.swiftpm
             build/ios/SourcePackages
+            ~/Library/Developer/Xcode/DerivedData/**/SourcePackages
           key: ${{ runner.os }}-spm-${{ hashFiles('ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}
           restore-keys: |
             ${{ runner.os }}-spm-
@@ -94,7 +101,7 @@ jobs:
           zip -qr DPIP.ipa Payload
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: DPIP-iOS
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 23fc72b0e..49c18e524 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -161,7 +161,7 @@ jobs:
       # precise key costs one full download on a dependency change and is
       # correct every time.
       - name: Cache pub packages
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.pub-cache
           key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.lock') }}
@@ -170,12 +170,23 @@ jobs:
       # (there is no Podfile). Uncached, every release re-clones and rebuilds
       # every package before the app's own code is even compiled — on the
       # runner that bills at ten times the Linux rate.
+      #
+      # Both clone directories, because the build below uses both: Flutter's
+      # step clones into build/ios/SourcePackages (it always passes
+      # -clonedSourcePackagesDirPath), and the xcodebuild archive after it,
+      # which does not, clones into DerivedData.
+      #
+      # The list is ios.yml's, line for line, and has to stay that way. A cache
+      # entry's version is a hash of these paths, so a different list is a
+      # different cache under the same key: every pull request missed the one
+      # main saved here and stored a fresh ~880 MB copy of its own.
       - name: Cache Swift packages
         if: matrix.platform == 'ios'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/Library/Caches/org.swift.swiftpm
+            build/ios/SourcePackages
             ~/Library/Developer/Xcode/DerivedData/**/SourcePackages
           key: ${{ runner.os }}-spm-${{ hashFiles('ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}
           restore-keys: |
@@ -377,7 +388,7 @@ jobs:
         if: always() && matrix.platform == 'ios'
         run: rm -rf "$RUNNER_TEMP/private_keys"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: dpip-${{ matrix.platform }}
           path: DPIP-*.*
@@ -393,7 +404,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           path: artifacts
           merge-multiple: true
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index 00aa6cc32..1c01e4b01 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -99,7 +99,7 @@ jobs:
       - name: Get PR context
         id: pr-context
         if: github.event_name == 'issue_comment'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             // For issue_comment events, resolve PR base/head so the action