diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b7fa6c73..ab02b24b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,23 +21,23 @@ jobs:
     runs-on: github-ubuntu-latest-s
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
+      - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
         with:
           version: 2026.10.10
           tool_versions: |
             java temurin-21
 
-      - uses: SonarSource/ci-github-actions/build-maven@v1
+      - uses: SonarSource/ci-github-actions/build-maven@v2
         with:
           artifactory-reader-role: private-reader
           artifactory-deployer-role: qa-deployer
           deploy-pull-request: true
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: test-results
           path: '**/target/surefire-reports/**/*.xml'
@@ -60,9 +60,9 @@ jobs:
           - SQ_VERSION: LATEST_RELEASE[2025.1]
             JAVA_VERSION: 17
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
+      - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
         with:
           version: 2026.10.10
           tool_versions: |
@@ -76,7 +76,7 @@ jobs:
             development/github/token/licenses-ro token | GITHUB_TOKEN
 
       - name: Configure Maven
-        uses: SonarSource/ci-github-actions/config-maven@v1
+        uses: SonarSource/ci-github-actions/config-maven@v2
         with:
           artifactory-reader-role: private-reader
 
@@ -87,14 +87,14 @@ jobs:
 
       - name: Upload server logs
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: server-logs-${{ github.job }}-${{ strategy.job-index }}
           path: "**/target/**/logs/**.log"
           if-no-files-found: ignore
 
       - name: Upload test results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: failure()
         with:
           name: test-results-${{ github.job }}-${{ strategy.job-index }}
@@ -106,12 +106,12 @@ jobs:
     needs: qa
     runs-on: github-ubuntu-latest-s
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
         with:
           cache_save: false
           version: 2026.10.10
-      - uses: SonarSource/ci-github-actions/get-build-number@v1
-      - uses: SonarSource/ci-github-actions/promote@v1
+      - uses: SonarSource/ci-github-actions/get-build-number@v2
+      - uses: SonarSource/ci-github-actions/promote@v2
         with:
           promote-pull-request: true
diff --git a/.github/workflows/pr_cleanup.yml b/.github/workflows/pr_cleanup.yml
index b074bc62..41e1b4e6 100644
--- a/.github/workflows/pr_cleanup.yml
+++ b/.github/workflows/pr_cleanup.yml
@@ -8,4 +8,4 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: SonarSource/ci-github-actions/pr_cleanup@v1
+      - uses: SonarSource/ci-github-actions/pr_cleanup@v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 99760c5e..cc209a35 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,17 +1,21 @@
 name: Release
-# This workflow is triggered when publishing a GitHub release
+# Run manually with the full version of an existing build to release.
 on:
-  release:
-    types:
-      - published
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Full version including build number, e.g. 1.2.3.456'
+        type: string
+        required: true
 
 jobs:
   run_release:
     permissions:
       contents: write
       id-token: write
-    uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v6
+    uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v7
     with:
+      version: ${{ inputs.version }}
       publishToBinaries: true
       mavenCentralSync: true
       slackChannel: ops-ci-experience
diff --git a/RELEASE.md b/RELEASE.md
new file mode 100644
index 00000000..3cc4e0df
--- /dev/null
+++ b/RELEASE.md
@@ -0,0 +1,19 @@
+# Releasing
+
+The [Release workflow](https://github.com/SonarSource/sonar-scanner-java-library/actions/workflows/release.yml)
+uses the [v7 draft-first release flow](https://github.com/SonarSource/gh-action_release/blob/v7/README.md#migrating-from-v6-to-v7-draft-first-workflow_dispatch).
+
+1. Select the branch or commit corresponding to the successfully built and promoted version.
+2. Go to **Actions → Release → Run workflow**, select that ref, and enter the full version including its build number (for example, `1.2.3.456`).
+   Alternatively, from this repository, run:
+
+   ```sh
+   gh workflow run release.yml --ref <release-ref> -f version=<full-version>
+   ```
+
+The workflow creates or reuses a draft GitHub release, runs releasability checks, promotes the artifacts,
+publishes to binaries and Maven Central, and publishes the GitHub release after those steps succeed.
+Publishing a release manually in the GitHub UI no longer starts the release workflow.
+
+If the workflow fails, fix the cause and re-run the failed workflow from GitHub Actions with the same version.
+The draft is retained for retries; a rebuild is not required. An already published release cannot be reused.