diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index 17a0ea9..292fa52 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -21,13 +21,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check and clean incomplete releases
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const tags = await github.rest.repos.listTags({
@@ -76,7 +76,7 @@ jobs:
 
       - name: Trigger release workflow
         if: steps.tag_version.outputs.new_tag != ''
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.repos.createDispatchEvent({
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index d5683e3..b514a90 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 826fd75..2f137de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Verify contract fixtures are coherent
         run: |
@@ -34,7 +34,7 @@ jobs:
       contents: read
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: sbt/setup-sbt@v1
 
@@ -81,7 +81,7 @@ jobs:
       contents: read
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Detect docs changes
         id: docs_changes
         uses: dorny/paths-filter@v4
@@ -121,7 +121,7 @@ jobs:
       security-events: write
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: CodeQL init
@@ -163,7 +163,7 @@ jobs:
             java: 17
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: sbt/setup-sbt@v1
 
@@ -199,7 +199,7 @@ jobs:
         spark: ["3.5.6"]
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: sbt/setup-sbt@v1
 
@@ -223,7 +223,7 @@ jobs:
       (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'run-integration-tests')) ||
       (github.event_name == 'push' && github.ref == 'refs/heads/main')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: sbt/setup-sbt@v1
       - uses: actions/setup-java@v5
         with:
@@ -241,7 +241,7 @@ jobs:
       contents: read
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: sbt/setup-sbt@v1
 
@@ -266,7 +266,7 @@ jobs:
       contents: read
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: sbt/setup-sbt@v1
 
@@ -287,7 +287,7 @@ jobs:
       contents: read
     if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip release]')"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: sbt/setup-sbt@v1
       - uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 69bc01a..be8e8dd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
 
       - name: Ensure CI succeeded for tag commit
         id: verify_ci
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           RELEASE_TAG: ${{ steps.tag.outputs.tag }}
         with:
@@ -110,7 +110,7 @@ jobs:
 
     steps:
       - name: Checkout tag
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: refs/tags/${{ env.RELEASE_TAG }}
           fetch-depth: 0
@@ -217,7 +217,7 @@ jobs:
           updateOnlyUnreleased: false
 
       - name: Trigger Changelog update
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             await github.rest.repos.createDispatchEvent({