diff --git a/.github/workflows/approve-contributor.yml b/.github/workflows/approve-contributor.yml
index c195fc69..cb5c2e70 100644
--- a/.github/workflows/approve-contributor.yml
+++ b/.github/workflows/approve-contributor.yml
@@ -13,13 +13,13 @@ jobs:
       issues: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.repository.default_branch }}
 
       - name: Add contributor to approved list
         id: update
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -88,7 +88,7 @@ jobs:
 
       - name: Comment on issue
         if: steps.update.outputs.status == 'added'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issueAuthor = context.payload.issue.user.login;
diff --git a/.github/workflows/approve-merged-contributor.yml b/.github/workflows/approve-merged-contributor.yml
index d2dd39f8..7885172d 100644
--- a/.github/workflows/approve-merged-contributor.yml
+++ b/.github/workflows/approve-merged-contributor.yml
@@ -13,13 +13,13 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.repository.default_branch }}
 
       - name: Add merged contributor to approved list
         id: update
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/build-artifacts-manual.yml b/.github/workflows/build-artifacts-manual.yml
index 23530a1c..7096c6c5 100644
--- a/.github/workflows/build-artifacts-manual.yml
+++ b/.github/workflows/build-artifacts-manual.yml
@@ -56,7 +56,7 @@ jobs:
       LIBGHOSTTY_VT_SIMD: ${{ inputs.libghostty_simd }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -110,7 +110,7 @@ jobs:
           python3 -c "import hashlib, pathlib; artifact = pathlib.Path('${{ matrix.name }}'); print(f'sha256={hashlib.sha256(artifact.read_bytes()).hexdigest()}  {artifact.name}')" >> BUILD_INFO.txt
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.name }}-${{ inputs.libghostty_optimize }}-simd-${{ inputs.libghostty_simd }}
           path: |
@@ -136,7 +136,7 @@ jobs:
       LIBGHOSTTY_VT_SIMD: ${{ inputs.libghostty_simd }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -172,7 +172,7 @@ jobs:
           python3 -c "import hashlib, pathlib; artifact = pathlib.Path('${{ matrix.name }}'); print(f'sha256={hashlib.sha256(artifact.read_bytes()).hexdigest()}  {artifact.name}')" >> BUILD_INFO.txt
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.name }}-${{ inputs.libghostty_optimize }}-simd-${{ inputs.libghostty_simd }}
           path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8427d384..01c58539 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,18 +25,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Install just
-        uses: extractions/setup-just@v3
+        uses: extractions/setup-just@v4
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@5f57d6cb7cd20b14a8a27f522884c4bc8a187458 # v2
+        uses: taiki-e/install-action@b550161ef8a7bc4f2a671c0b03a18ac9ccedea1e # v2
         with:
           tool: cargo-nextest
 
diff --git a/.github/workflows/label-intends-to-pr.yml b/.github/workflows/label-intends-to-pr.yml
index 731f0f82..d25985b7 100644
--- a/.github/workflows/label-intends-to-pr.yml
+++ b/.github/workflows/label-intends-to-pr.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Sync intends-to-pr label
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const label = process.env.INTENDS_TO_PR_LABEL;
diff --git a/.github/workflows/label-next-release-issues.yml b/.github/workflows/label-next-release-issues.yml
index fbbf3131..f1e2074e 100644
--- a/.github/workflows/label-next-release-issues.yml
+++ b/.github/workflows/label-next-release-issues.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index d04fef29..f59f49ad 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check if contributor is approved
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const prAuthor = context.payload.pull_request.user.login;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7393694c..c5c84f66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
       LIBGHOSTTY_VT_SIMD: ${{ matrix.libghostty_vt_simd }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -104,7 +104,7 @@ jobs:
         run: cp target/${{ matrix.target }}/release/herdr ${{ matrix.name }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.name }}
           path: ${{ matrix.name }}
@@ -116,18 +116,18 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Extract release notes from changelog
         run: python3 scripts/changelog.py extract --version "${GITHUB_REF_NAME#v}" --output RELEASE_NOTES.md
 
       - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             herdr-linux-x86_64/herdr-linux-x86_64
@@ -145,7 +145,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -270,7 +270,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: master
           fetch-depth: 0