diff --git a/.github/workflows/aur-check.yml b/.github/workflows/aur-check.yml
index 2f70d028..cbec4998 100644
--- a/.github/workflows/aur-check.yml
+++ b/.github/workflows/aur-check.yml
@@ -23,7 +23,7 @@ jobs:
         run: pacman -Syu --noconfirm git sudo namcap
 
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up build user
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc614a7a..fee18732 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -44,16 +44,16 @@ jobs:
           - windows-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           # Pin a modern Go instead of go.mod's `go 1.22`: the 1.22 macOS
           # linker omits the LC_UUID load command, which the updated
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d5746380..17468999 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 4da645e1..f5e0a2a0 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -27,20 +27,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Derive image tags and labels
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.IMAGE }}
           tags: |
@@ -50,7 +50,7 @@ jobs:
             type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index d98fbfce..5fa0555e 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -25,7 +25,7 @@ jobs:
         download-attempts = 5
         connect-timeout = 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
diff --git a/.github/workflows/nix-update.yml b/.github/workflows/nix-update.yml
index b79a5313..8737697f 100644
--- a/.github/workflows/nix-update.yml
+++ b/.github/workflows/nix-update.yml
@@ -30,7 +30,7 @@ jobs:
         download-attempts = 5
         connect-timeout = 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -88,7 +88,7 @@ jobs:
         run: nix build --fallback .#zennotes-desktop .#zennotes-server --no-link --print-build-logs
 
       - name: Open a PR with the update
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v8
         with:
           branch: nix/update-v${{ inputs.version }}
           add-paths: packaging/nix/release-data.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 26ef3b22..6db949cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,10 +66,10 @@ jobs:
       REQUIRE_MAC_SIGNING: "true"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/verify-release-channels.yml b/.github/workflows/verify-release-channels.yml
index 2e0bf04a..8d3cce51 100644
--- a/.github/workflows/verify-release-channels.yml
+++ b/.github/workflows/verify-release-channels.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22