diff --git a/TODO.md b/TODO.md
index 4fa33f2..f64816a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -18,7 +18,7 @@
 ---
 ## Summary
 
-_Last updated: 2026-05-11 (post Sprint 11: §6.6 Tier-2 Toolchain DONE — PowerShell 7.4.7, NSIS 3.10, CMake 3.31.6, Node.js 22.14.0, WiX 4.0.5, gh CLI 2.67.0, Sysinternals, vcpkg — Step 12 in Setup-WinBuild2025.ps1)_
+_Last updated: 2026-05-11 (post Sprint 11: §6.6 Tier-2 Toolchain DONE — PowerShell 7.6.1, NSIS 3.12, CMake 3.31.6, Node.js 22.14.0, WiX 4.0.5, gh CLI 2.92.0, Sysinternals, vcpkg — Step 12 in Setup-WinBuild2025.ps1)_
 
 **Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6.1 Linux Build VM completato con e2e PASS (nsis7z.dll 2272 KB, parità Windows). §6.6 Tier-1+Tier-2 completati nel template (Step 11+12). Prossimi P2: Test Plan + §6.2-6.5.
 
@@ -516,9 +516,9 @@ build più ampi senza toccare il template.
 | ------------------- | ---------------- | ------------------------------------------------------ |
 | **Git for Windows** | 2.54.0.windows.1 | Self-clone in VM, submodule fetch, fallback §3.2       |
 | **7-Zip**           | 26.01            | Unpack/zip universale; usato da Step 12 stesso (vcpkg) |
-| **PowerShell 7.x**  | 7.4.7 (LTS)      | Parallel pipelines, operatori moderni, pwsh in CI      |
-| **NSIS**            | 3.10             | Build installer Windows (es. `nsis-plugin-nsinnounp`)  |
-| **gh CLI**          | 2.67.0           | Upload artifact a release Gitea/GitHub, comment PR     |
+| **PowerShell 7.x**  | 7.6.1            | Parallel pipelines, operatori moderni, pwsh in CI      |
+| **NSIS**            | 3.12             | Build installer Windows (es. `nsis-plugin-nsinnounp`)  |
+| **gh CLI**          | 2.92.0           | Upload artifact a release Gitea/GitHub, comment PR     |
 
 ### Tier-2 — Step 12 (implementato)
 
diff --git a/template/Prepare-WinBuild2025.ps1 b/template/Prepare-WinBuild2025.ps1
index dd6139d..b811799 100644
--- a/template/Prepare-WinBuild2025.ps1
+++ b/template/Prepare-WinBuild2025.ps1
@@ -133,12 +133,12 @@ param(
     [string] $DotNetSdkVersion = '10.0',
 
     # Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2025.ps1
-    [string] $Pwsh7Version   = '7.4.7',
-    [string] $NSISVersion    = '3.10',
+    [string] $Pwsh7Version   = '7.6.1',
+    [string] $NSISVersion    = '3.12',
     [string] $CMakeVersion   = '3.31.6',
     [string] $NodeJSVersion  = '22.14.0',
     [string] $WiXVersion     = '4.0.5',
-    [string] $GhCliVersion   = '2.67.0',
+    [string] $GhCliVersion   = '2.92.0',
     [string] $VcpkgRef       = '',
 
     # Skip Tier-2 Toolchain — forwarded to Setup-WinBuild2025.ps1 -SkipTier2
diff --git a/template/Setup-WinBuild2025.ps1 b/template/Setup-WinBuild2025.ps1
index 7c9c58f..ab3dd76 100644
--- a/template/Setup-WinBuild2025.ps1
+++ b/template/Setup-WinBuild2025.ps1
@@ -160,10 +160,10 @@ param(
     # Update these defaults when upgrading pinned tool versions.
 
     # PowerShell 7 LTS (pwsh.exe — modern PS for CI scripts + parallel pipelines)
-    [string] $Pwsh7Version = '7.4.7',
+    [string] $Pwsh7Version = '7.6.1',
 
     # NSIS (makensis.exe — Windows installer builds)
-    [string] $NSISVersion = '3.10',
+    [string] $NSISVersion = '3.12',
 
     # CMake (cmake.exe — C/C++ cross-platform build system)
     [string] $CMakeVersion = '3.31.6',
@@ -175,7 +175,7 @@ param(
     [string] $WiXVersion = '4.0.5',
 
     # GitHub CLI (gh.exe — artifact upload, PR/release/workflow operations)
-    [string] $GhCliVersion = '2.67.0',
+    [string] $GhCliVersion = '2.92.0',
 
     # vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone.
     [string] $VcpkgRef = '',