diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index 65f5ef94b..c2b6926cc 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -26,7 +26,7 @@ jobs:
       datafiles_archive: ${{ steps.meta.outputs.datafiles_archive }}
       checksums_file: ${{ steps.meta.outputs.checksums_file }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -74,7 +74,7 @@ jobs:
     env:
       BINARY_VERSION: ${{ needs.prep.outputs.binary_version }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-go
@@ -142,7 +142,7 @@ jobs:
       CHECKSUMS_FILE: ${{ needs.prep.outputs.checksums_file }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/discord-notify.yml b/.github/workflows/discord-notify.yml
index 5fcde7ef9..4536ac4ed 100644
--- a/.github/workflows/discord-notify.yml
+++ b/.github/workflows/discord-notify.yml
@@ -15,7 +15,7 @@ jobs:
     if: ${{ !github.event.pull_request.draft }}
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Resolve Discord webhook URL
         id: webhook
         run: |
diff --git a/.github/workflows/docker-package.yml b/.github/workflows/docker-package.yml
index 41c7bc6db..ba0d2a98c 100644
--- a/.github/workflows/docker-package.yml
+++ b/.github/workflows/docker-package.yml
@@ -27,7 +27,7 @@ jobs:
       attestations: write
       id-token: write
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -36,10 +36,10 @@ jobs:
         run: echo "version=$(make go-version)" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@v4.1.0
 
       - name: Log in to the Container registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v4.1.0
+        uses: docker/login-action@v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -47,7 +47,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6.0.0
+        uses: docker/metadata-action@v6.1.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -59,7 +59,7 @@ jobs:
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v7.0.0
+        uses: docker/build-push-action@v7.2.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
@@ -73,7 +73,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v4.1.0
+        uses: actions/attest-build-provenance@v4.1.1
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3f42f7009..6b485dbc8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -27,7 +27,7 @@ jobs:
       js_lint: >-
         ${{ steps.filter.outputs.js_lint }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -59,7 +59,7 @@ jobs:
   go-lint:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -74,12 +74,12 @@ jobs:
     if: >-
       needs.detect-changes.outputs.js_lint == 'true'
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 
diff --git a/.github/workflows/run-test.yml b/.github/workflows/run-test.yml
index 23dde67e2..27c875ea1 100644
--- a/.github/workflows/run-test.yml
+++ b/.github/workflows/run-test.yml
@@ -24,7 +24,7 @@ jobs:
   test:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-go
diff --git a/.github/workflows/update-go-toolchain.yml b/.github/workflows/update-go-toolchain.yml
index 78f0faa90..0f140b999 100644
--- a/.github/workflows/update-go-toolchain.yml
+++ b/.github/workflows/update-go-toolchain.yml
@@ -21,13 +21,13 @@ jobs:
       BASE_BRANCH: master
       PR_BRANCH: automation/update-go-toolchain
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Detect latest stable Go release
         id: detect
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('node:fs')
@@ -79,7 +79,7 @@ jobs:
 
       - name: Set up Go
         if: steps.detect.outputs.changed == 'true'
-        uses: actions/setup-go@v6.4.0
+        uses: actions/setup-go@v6.5.0
         with:
           go-version: ${{ steps.detect.outputs.version }}
           cache: true