diff --git a/.github/workflows/caddy-image.yml b/.github/workflows/caddy-image.yml
index 4e12faf7..11405175 100644
--- a/.github/workflows/caddy-image.yml
+++ b/.github/workflows/caddy-image.yml
@@ -27,14 +27,14 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v7.0.0
-      - uses: docker/setup-qemu-action@v4.1.0
+      - uses: docker/setup-qemu-action@v4.2.0
       - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@v7.2.0
+      - uses: docker/build-push-action@v7.3.0
         with:
           context: docker/caddy
           file: docker/caddy/Containerfile
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 06d3e12a..bbd13287 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,11 +22,11 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.0
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.36.2
+        uses: github/codeql-action/init@v4.37.2
         with:
           languages: rust
           build-mode: none
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4.36.2
+        uses: github/codeql-action/analyze@v4.37.2
         with:
           category: "/language:rust"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index f96ba87f..86be9413 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -35,7 +35,7 @@ jobs:
           rustup toolchain install --profile minimal --no-self-update stable
           rustup default stable
           rustup component add llvm-tools-preview
-      - uses: taiki-e/install-action@v2.82.2
+      - uses: taiki-e/install-action@v2.84.0
         with:
           tool: cargo-llvm-cov
       # Coverage builds are instrumented, so keep them in their own cache to
@@ -50,7 +50,7 @@ jobs:
         run: mkdir -p crates/web/frontend/dist
       - name: cargo llvm-cov
         run: cargo llvm-cov --workspace --locked --cobertura --output-path cobertura-rust.xml
-      - uses: actions/upload-code-coverage@v1.3.0
+      - uses: actions/upload-code-coverage@v1.4.1
         with:
           file: cobertura-rust.xml
           language: Rust
@@ -73,7 +73,7 @@ jobs:
         run: npm ci
       - name: Vitest coverage
         run: npx --no-install vitest run --coverage
-      - uses: actions/upload-code-coverage@v1.3.0
+      - uses: actions/upload-code-coverage@v1.4.1
         # `uses` steps run from the workspace root, not the job's
         # working-directory, so give the full path to the report.
         with:
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 5be81b96..6de50904 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -20,7 +20,7 @@ jobs:
         run: |
           rustup toolchain install --profile minimal --no-self-update nightly
           rustup default nightly
-      - uses: taiki-e/install-action@v2.82.2
+      - uses: taiki-e/install-action@v2.84.0
         with:
           tool: cargo-fuzz
       - uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 9b5fd4c9..ead3ac5b 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.84.0
         with:
           tool: git-cliff
       - name: Create release for an untagged version bump
@@ -85,7 +85,7 @@ jobs:
         run: |
           rustup toolchain install --profile minimal --no-self-update stable
           rustup default stable
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.84.0
         with:
           tool: git-cliff
       - name: Compute next version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 521bffa7..7e87caa4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -278,18 +278,18 @@ jobs:
           done
 
       - name: Attest tarball provenance
-        uses: actions/attest-build-provenance@v4.1.0
+        uses: actions/attest-build-provenance@v4.1.1
         with:
           subject-path: "*.tar.zst"
 
       - name: Attest deb provenance
         if: matrix.deb
-        uses: actions/attest-build-provenance@v4.1.0
+        uses: actions/attest-build-provenance@v4.1.1
         with:
           subject-path: "*.deb"
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6.2.0
+        uses: aws-actions/configure-aws-credentials@v6.2.2
         with:
           aws-region: ap-southeast-2
           role-to-assume: arn:aws:iam::143295493206:role/gha-tamanu-tools-upload