diff --git a/.github/workflows/build-dockerfile.yml b/.github/workflows/build-dockerfile.yml
index 31da1474..d1625781 100644
--- a/.github/workflows/build-dockerfile.yml
+++ b/.github/workflows/build-dockerfile.yml
@@ -80,7 +80,7 @@ jobs:
         run: pip install -r requirements.txt
 
       - name: Restore test dataset
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           key: ${{ needs.cache-test-datasets.outputs.cache-key }}
           path: test/data/
@@ -132,20 +132,20 @@ jobs:
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # 3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # 3.12.0
         with:
           platforms: linux/amd64,linux/arm64
 
@@ -157,7 +157,7 @@ jobs:
 
       - name: Build Docker image (x86)
         if: github.event_name != 'pull_request'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ${{ github.workspace }}
           load: true
@@ -175,7 +175,7 @@ jobs:
 
       - name: Build Docker image (x86; PR)
         if: github.event_name == 'pull_request'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ${{ github.workspace }}
           load: true
@@ -197,7 +197,7 @@ jobs:
 
       - name: Build Docker image (arm64)
         if: github.event_name != 'pull_request'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ${{ github.workspace }}
           push: false
@@ -214,7 +214,7 @@ jobs:
 
       - name: Push image to registries
         if: github.event_name != 'pull_request'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ${{ github.workspace }}
           push: true
diff --git a/.github/workflows/build-package.yml b/.github/workflows/build-package.yml
index 71e602eb..ae40e853 100644
--- a/.github/workflows/build-package.yml
+++ b/.github/workflows/build-package.yml
@@ -68,7 +68,7 @@ jobs:
         run: python -m build . -v --outdir out/dist/
 
       - name: Upload distribution
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: dist
           path: out/
@@ -88,7 +88,7 @@ jobs:
 
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: dist
 
diff --git a/.github/workflows/cache-test-datasets.yml b/.github/workflows/cache-test-datasets.yml
index 3c0fcc2d..c4d4f93a 100644
--- a/.github/workflows/cache-test-datasets.yml
+++ b/.github/workflows/cache-test-datasets.yml
@@ -69,7 +69,7 @@ jobs:
 
       - name: Restore cache
         id: cache-dset
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           key: ${{ steps.generate-cache-key.outputs.key }}
           path: test/data/
@@ -93,7 +93,7 @@ jobs:
         run: md5sum -c checksums.md5
 
       - name: Save cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         if: steps.cache-dset.outputs.cache-hit != 'true'
         with:
           key: ${{ steps.generate-cache-key.outputs.key }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73420d2c..4f8e0429 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,7 +114,7 @@ jobs:
           stripepy --version
 
       - name: Restore test dataset
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           key: ${{ needs.cache-test-datasets.outputs.cache-key }}
           path: test/data/
@@ -132,7 +132,7 @@ jobs:
 
       - name: Upload unit test coverage report to Codecov
         if: (! matrix.minimal_install)
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           flags: "tests | unit | python-${{ matrix.python_version }}"
           disable_search: true
@@ -143,7 +143,7 @@ jobs:
 
       - name: Upload unit test coverage report to Codecov (core)
         if: matrix.minimal_install
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           flags: "tests | unit | python-${{ matrix.python_version }} | core"
           disable_search: true
@@ -164,7 +164,7 @@ jobs:
 
       - name: Upload end2end test coverage report to Codecov
         if: (! matrix.minimal_install)
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           flags: "tests | integration | python-${{ matrix.python_version }}"
           disable_search: true
@@ -175,7 +175,7 @@ jobs:
 
       - name: Upload end2end test coverage report to Codecov (core)
         if: matrix.minimal_install
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           flags: "tests | integration | python-${{ matrix.python_version }} | core"
           disable_search: true