diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 46810bd7..c48c8bf2 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -52,9 +52,9 @@ jobs:
 
     name: CI testing
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - name: Setup Golang with cache
-        uses: magnetikonline/action-golang-cache@v4
+        uses: magnetikonline/action-golang-cache@v5
         with:
           # Pin a modern Go toolchain instead of go.mod's `go 1.19`: modern build tools
           # (sql-migrate) now ship go.mod directives (`go 1.24.0`) that Go 1.19 cannot parse.
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
old mode 100755
new mode 100644
index 83916796..b4119147
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -5,7 +5,7 @@ jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v2
\ No newline at end of file
+      - uses: wagoid/commitlint-github-action@v6
\ No newline at end of file
diff --git a/.github/workflows/gke-dev.yml b/.github/workflows/gke-dev.yml
old mode 100755
new mode 100644
index 1a653803..36523a49
--- a/.github/workflows/gke-dev.yml
+++ b/.github/workflows/gke-dev.yml
@@ -19,16 +19,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - id: "auth"
         name: "Authenticate to Google Cloud"
-        uses: "google-github-actions/auth@v0"
+        uses: "google-github-actions/auth@v3"
         with:
           credentials_json: "${{ secrets.GCP_CREDENTIALS }}"
 
       - name: "Set up Cloud SDK"
-        uses: "google-github-actions/setup-gcloud@v0"
+        uses: "google-github-actions/setup-gcloud@v3"
 
       - name: Setup Docker
         run: |
diff --git a/.github/workflows/gke-prod.yml b/.github/workflows/gke-prod.yml
old mode 100755
new mode 100644
index e1dd348e..5d90311e
--- a/.github/workflows/gke-prod.yml
+++ b/.github/workflows/gke-prod.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify changelog
-        uses: fjogeleit/http-request-action@v1
+        uses: fjogeleit/http-request-action@v2
         with:
           url: 'https://chglg.fly.dev/v1/changelog'
           method: 'POST'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5a4d4b25..5c25aa08 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,11 +19,11 @@ jobs:
     name: release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3 # v3
+      - uses: actions/checkout@v7 # v3
         with:
           fetch-depth: 0 # to be able to checkout any commit
           persist-credentials: false # <--- this
-      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v3
         with:
           cache: npm
           node-version: lts/*
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index d0485daf..1b640a51 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,7 +9,7 @@ jobs:
   gitleaks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: gitleaks (release binary, no license)
@@ -21,8 +21,8 @@ jobs:
   govulncheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
         with:
           go-version: stable
       - name: govulncheck (advisory, non-blocking)
@@ -35,11 +35,11 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: 20
       - name: dependency audit (advisory, non-blocking)