diff --git a/.github/actions/setup/action.yaml b/.github/actions/setup/action.yaml
index d061192..80019b2 100644
--- a/.github/actions/setup/action.yaml
+++ b/.github/actions/setup/action.yaml
@@ -27,7 +27,7 @@ runs:
           printf "%s" "$ENV" | jq -er 'to_entries[] | "\(.key)=\(.value)"'
         } > .env
     - name: "Restore caches"
-      uses: "actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae" # v5.0.5
+      uses: "actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
       with:
         path: ".cache"
         key: "${{ inputs.cache-key }}-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml') }}"
diff --git a/.github/actions/upload-reports/action.yaml b/.github/actions/upload-reports/action.yaml
index 4db77cc..a14f196 100644
--- a/.github/actions/upload-reports/action.yaml
+++ b/.github/actions/upload-reports/action.yaml
@@ -11,13 +11,13 @@ runs:
   using: "composite"
   steps:
     - name: "Upload coverage to Codecov"
-      uses: "codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2" # v6.0.0
+      uses: "codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f" # v7.0.0
       with:
         use_oidc: true
         report_type: "coverage"
         files: "${{ inputs.test-coverage }}"
     - name: "Upload test results to Codecov"
-      uses: "codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2" # v6.0.0
+      uses: "codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f" # v7.0.0
       with:
         use_oidc: true
         report_type: "test_results"
diff --git a/.github/workflows/regular.yaml b/.github/workflows/regular.yaml
index e32ba13..5fd9959 100644
--- a/.github/workflows/regular.yaml
+++ b/.github/workflows/regular.yaml
@@ -29,7 +29,7 @@ jobs:
       mise-version: "${{ steps.init.outputs.mise-version }}"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -47,7 +47,7 @@ jobs:
       id-token: "write" # for OIDC authentication
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -76,7 +76,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     steps:
       - name: "Checkout repository"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -96,7 +96,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     steps:
       - name: "Checkout repository"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0752c65..e84f035 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
       mise-version: "${{ steps.init.outputs.mise-version }}"
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -50,7 +50,7 @@ jobs:
       attestations: "write" # for build provenance
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
@@ -98,13 +98,13 @@ jobs:
       id-token: "write" # for OIDC authentication
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           ref: "${{ github.ref }}"
           fetch-depth: 1
           persist-credentials: false
       - name: "Install latest Node.js with correct .npmrc"
-        uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6.4.0
+        uses: "actions/setup-node@820762786026740c76f36085b0efc47a31fe5020" # v7.0.0
         with:
           node-version: "latest"
           check-latest: true
@@ -143,7 +143,7 @@ jobs:
     permissions: {}
     steps:
       - name: "Install Node.js"
-        uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6.4.0
+        uses: "actions/setup-node@820762786026740c76f36085b0efc47a31fe5020" # v7.0.0
         with:
           node-version: "latest"
           check-latest: true