diff --git a/.github/workflows/auto-review.yml b/.github/workflows/auto-review.yml
index a26afac0..65acfe12 100644
--- a/.github/workflows/auto-review.yml
+++ b/.github/workflows/auto-review.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Generate Bootc Actions Token
         id: bootc_token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/autovendor.yml b/.github/workflows/autovendor.yml
index 7df33fcf..72ddf6e9 100644
--- a/.github/workflows/autovendor.yml
+++ b/.github/workflows/autovendor.yml
@@ -18,7 +18,7 @@ jobs:
         run: cargo install cargo-vendor-filterer
       - name: Run
         run: mkdir -p target && cd crates/cli && cargo vendor-filterer --format=tar.zstd --prefix=vendor/ ../../target/vendor.tar.zst
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: vendor.tar.zst
           path: target/vendor.tar.zst
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea0a6d67..c7490f84 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,7 +161,7 @@ jobs:
 
       - name: Archive TMT logs
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: tmt-log-PR-${{ github.event.number }}-${{ matrix.test_os }}-ostree-${{ env.ARCH }}
           path: /var/tmp/tmt
@@ -227,7 +227,7 @@ jobs:
 
       - name: Archive TMT logs
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: tmt-log-PR-${{ github.event.number }}-${{ matrix.test_os }}-cfs-${{ env.ARCH }}
           path: /var/tmp/tmt
diff --git a/.github/workflows/debug-arm64-upterm.yml b/.github/workflows/debug-arm64-upterm.yml
index a1fd4c9f..e57156dd 100644
--- a/.github/workflows/debug-arm64-upterm.yml
+++ b/.github/workflows/debug-arm64-upterm.yml
@@ -9,7 +9,7 @@ jobs:
   debug-arm64:
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Show system info
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e5089e4..e2b76f2f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.APP_ID }}
@@ -53,7 +53,7 @@ jobs:
 
       - name: Import GPG key
         if: github.event_name != 'push'
-        uses: crazy-max/ghaction-import-gpg@v6
+        uses: crazy-max/ghaction-import-gpg@v7
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
diff --git a/.github/workflows/scheduled-release.yml b/.github/workflows/scheduled-release.yml
index badd0fc2..12b15cdd 100644
--- a/.github/workflows/scheduled-release.yml
+++ b/.github/workflows/scheduled-release.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.APP_ID }}
@@ -71,7 +71,7 @@ jobs:
 
       - name: Import GPG key
         if: steps.check_schedule.outputs.should_release == 'true'
-        uses: crazy-max/ghaction-import-gpg@v6
+        uses: crazy-max/ghaction-import-gpg@v7
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -97,7 +97,7 @@ jobs:
           echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         env:
           VERSION: ${{ steps.create_commit.outputs.VERSION }}
         with:
diff --git a/crates/ostree-ext/.github/workflows/rust.yml b/crates/ostree-ext/.github/workflows/rust.yml
index efd69808..eed6b128 100644
--- a/crates/ostree-ext/.github/workflows/rust.yml
+++ b/crates/ostree-ext/.github/workflows/rust.yml
@@ -57,7 +57,7 @@ jobs:
       - name: Build
         run: cargo build --release --features=internal-testing-api
       - name: Upload binary
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: ostree-ext-cli
           path: target/release/ostree-ext-cli
@@ -105,7 +105,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Download ostree-ext-cli
-        uses: actions/download-artifact@v6.0.0
+        uses: actions/download-artifact@v8.0.1
         with:
           name: ostree-ext-cli
       - name: Install
@@ -121,7 +121,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Download ostree-ext-cli
-        uses: actions/download-artifact@v6.0.0
+        uses: actions/download-artifact@v8.0.1
         with:
           name: ostree-ext-cli
       - name: Install
@@ -139,7 +139,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Download
-        uses: actions/download-artifact@v6.0.0
+        uses: actions/download-artifact@v8.0.1
         with:
           name: ostree-ext-cli
       - name: Install
@@ -159,7 +159,7 @@ jobs:
           repository: coreos/coreos-layering-examples
           path: coreos-layering-examples
       - name: Download
-        uses: actions/download-artifact@v6.0.0
+        uses: actions/download-artifact@v8.0.1
         with:
           name: ostree-ext-cli
       - name: Integration tests