diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 5cff10452..4b64ade6d 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -55,7 +55,7 @@ jobs:
           esac
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -108,14 +108,17 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
           # The distro prefix matters: the same Ubuntu-runner cache scope
           # backs three different container distros.
-          key: vcpkg-${{ matrix.distro }}-x64-linux-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ matrix.distro }}-x64-linux-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ matrix.distro }}-x64-linux-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ matrix.distro }}-x64-linux-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -162,7 +165,7 @@ jobs:
         shell: bash
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-linux-${{ matrix.distro }}
           path: |
@@ -180,7 +183,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -214,12 +217,15 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-appimage-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-appimage-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-appimage-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-appimage-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -255,7 +261,7 @@ jobs:
         run: cargo packager --release --formats appimage
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-linux-appimage
           path: target/release/*.AppImage
@@ -267,7 +273,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -293,12 +299,15 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -356,7 +365,7 @@ jobs:
             -srcfolder dmg-staging -ov -format UDZO Oak-macOS-arm64.dmg
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-macos
           path: Oak-macOS-arm64.dmg
@@ -373,7 +382,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: true
 
@@ -400,12 +409,15 @@ jobs:
           "VCPKG_ROOT=$env:GITHUB_WORKSPACE\.cache\vcpkg" >> $env:GITHUB_ENV
 
       - name: Cache vcpkg artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             vcpkg_installed
             ~/AppData/Local/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
           save-always: true
 
       - name: Install dependencies (vcpkg manifest)
@@ -460,7 +472,7 @@ jobs:
         run: cargo packager --release --formats nsis
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: oak-windows
           path: target/release/*-setup.exe
@@ -477,13 +489,13 @@ jobs:
     runs-on: warp-ubuntu-latest-x64-8x
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
 
       - name: Publish release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b3a38c51e..47b2a6aef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: warp-ubuntu-latest-x64-8x
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # gpui/ is a git submodule; its crates are workspace members of
           # their own repo and build as path dependencies of oakapp.
@@ -71,15 +71,20 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       # The archives dir is vcpkg's binary cache: a manifest bump then
-      # rebuilds only what changed. Same key scheme as the Windows job.
+      # rebuilds only what changed. Every run saves under a fresh key
+      # (so an existing cache is updated, never a save failure) and
+      # restores the newest matching entry through `restore-keys`.
       - name: Restore vcpkg artifacts
         id: vcpkg-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
 
       - name: Install dependencies (vcpkg manifest)
         run: vcpkg install --triplet x64-linux
@@ -91,7 +96,7 @@ jobs:
       # (~40 min on Windows).
       - name: Save vcpkg artifacts
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           path: |
             vcpkg_installed
@@ -144,6 +149,7 @@ jobs:
       # and no failure, so after 1800 s it dumps every hung process's
       # thread stacks and kills the suite.
       - name: Test
+        timeout-minutes: 40
         env:
           # lavapipe is present on this job: a missing adapter must fail
           # the GPU acceptance tests instead of silently skipping them.
@@ -244,7 +250,7 @@ jobs:
     runs-on: warp-windows-2025-vs2026-x64-32x
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # gpui/ is a git submodule; its crates are workspace members of
           # their own repo and build as path dependencies of oakapp.
@@ -309,12 +315,15 @@ jobs:
 
       - name: Restore vcpkg artifacts
         id: vcpkg-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           path: |
             vcpkg_installed
             ~/AppData/Local/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
 
       - name: Install dependencies (vcpkg manifest)
         run: vcpkg install --triplet x64-windows
@@ -324,7 +333,7 @@ jobs:
       # for ~40 minutes on every run).
       - name: Save vcpkg artifacts
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           path: |
             vcpkg_installed
@@ -372,6 +381,7 @@ jobs:
         run: cargo check --workspace --locked
 
       - name: Test
+        timeout-minutes: 40
         run: |
           cargo test --workspace --locked
           if ($LASTEXITCODE -ne 0) {
@@ -390,7 +400,7 @@ jobs:
     runs-on: warp-macos-26-arm64-12x
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # gpui/ is a git submodule; its crates are workspace members of
           # their own repo and build as path dependencies of oakapp.
@@ -422,22 +432,27 @@ jobs:
           echo "VCPKG_ROOT=$PWD/.cache/vcpkg" >> "$GITHUB_ENV"
 
       # The archives dir is vcpkg's binary cache: a manifest bump then
-      # rebuilds only what changed. Same key scheme as the Windows job.
+      # rebuilds only what changed. Every run saves under a fresh key
+      # (so an existing cache is updated, never a save failure) and
+      # restores the newest matching entry through `restore-keys`.
       - name: Restore vcpkg artifacts
         id: vcpkg-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-
 
       - name: Install dependencies (vcpkg manifest)
         run: vcpkg install --triplet arm64-osx
 
       - name: Save vcpkg artifacts
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           path: |
             vcpkg_installed
@@ -480,6 +495,7 @@ jobs:
       # The runner's GUI session doubles as the display for the gpui
       # #[gpui::test] windows; wgpu renders through Metal.
       - name: Test
+        timeout-minutes: 40
         run: |
           # Retry once (same policy as the other platforms): worker-pool
           # startup under full-suite parallelism has flaked on Linux. A
@@ -524,7 +540,7 @@ jobs:
         run: apt-get update && apt-get install -y git curl ca-certificates
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # gpui/ is a git submodule; its crates are workspace members of
           # their own repo and build as path dependencies of oakapp.
@@ -581,21 +597,24 @@ jobs:
       # rebuilds only what changed.
       - name: Restore vcpkg artifacts
         id: vcpkg-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           path: |
             vcpkg_installed
             ~/.cache/vcpkg/archives
           # The arch prefix matters here: both jobs run the same distro
           # image through the same cache scope, unlike the OS jobs.
-          key: vcpkg-${{ runner.os }}-${{ matrix.arch }}-openkylin-${{ hashFiles('vcpkg.json') }}
+          key: vcpkg-${{ runner.os }}-${{ matrix.arch }}-openkylin-${{ hashFiles('vcpkg.json') }}-${{ github.run_id }}-${{ github.run_attempt }}
+          restore-keys: |
+            vcpkg-${{ runner.os }}-${{ matrix.arch }}-openkylin-${{ hashFiles('vcpkg.json') }}-
+            vcpkg-${{ runner.os }}-${{ matrix.arch }}-openkylin-
 
       - name: Install dependencies (vcpkg manifest)
         run: vcpkg install --triplet ${{ matrix.triplet }}
 
       - name: Save vcpkg artifacts
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           path: |
             vcpkg_installed