diff --git a/.github/workflows/auto-publish-pr.yaml b/.github/workflows/auto-publish-pr.yaml
index 2a4e00a2ef..9fd597261a 100644
--- a/.github/workflows/auto-publish-pr.yaml
+++ b/.github/workflows/auto-publish-pr.yaml
@@ -213,7 +213,7 @@ jobs:
 
     steps:
       - name: Checkout overlay repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ needs.prepare.outputs.overlay-repo }}
           ref: ${{ needs.prepare.outputs.overlay-branch }}
@@ -244,7 +244,7 @@ jobs:
           echo "node-version=${node_version}" >> $GITHUB_OUTPUT
 
       - name: Checkout plugins repository (flat)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.source-config.outputs.plugins-root == '.'
         with:
           repository: ${{ steps.source-config.outputs.plugins-repo }}
@@ -252,7 +252,7 @@ jobs:
           path: source-repo
 
       - name: Checkout plugins repository (workspace)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.source-config.outputs.plugins-root != '.'
         with:
           repository: ${{ steps.source-config.outputs.plugins-repo }}
@@ -263,7 +263,7 @@ jobs:
           path: source-repo
 
       - name: Setup Node.js ${{ steps.source-config.outputs.node-version }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ steps.source-config.outputs.node-version }}
 
@@ -348,7 +348,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ needs.prepare.outputs.overlay-repo }}
           ref: ${{ needs.prepare.outputs.overlay-branch }}
@@ -374,7 +374,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.check-e2e.outputs.has-e2e == 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
 
diff --git a/.github/workflows/check-backstage-compatibility.yaml b/.github/workflows/check-backstage-compatibility.yaml
index 6d24615e91..34f61218e9 100644
--- a/.github/workflows/check-backstage-compatibility.yaml
+++ b/.github/workflows/check-backstage-compatibility.yaml
@@ -36,7 +36,7 @@ jobs:
   prepare-required-plugins:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       - name: Create the required-plugins file@
         continue-on-error: true
@@ -67,7 +67,7 @@ jobs:
     if: always() && github.ref == 'refs/heads/main'
     steps:      
       - name: Checkout metadata branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: metadata
 
@@ -118,10 +118,10 @@ jobs:
     if: always() && github.ref == 'refs/heads/main'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout wiki
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}.wiki
           path: wiki
diff --git a/.github/workflows/community-plugin-sweep.yaml b/.github/workflows/community-plugin-sweep.yaml
index 3c8d502b33..8ee6146631 100644
--- a/.github/workflows/community-plugin-sweep.yaml
+++ b/.github/workflows/community-plugin-sweep.yaml
@@ -77,7 +77,7 @@ jobs:
       shard-count: ${{ steps.plan.outputs.shard-count }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -85,7 +85,7 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
@@ -161,7 +161,7 @@ jobs:
         working-directory: smoke-tests-native
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -169,7 +169,7 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
@@ -239,7 +239,7 @@ jobs:
         working-directory: smoke-tests-native
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -247,7 +247,7 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
diff --git a/.github/workflows/create-release-branch.yaml b/.github/workflows/create-release-branch.yaml
index c9fe3d7516..014d2c894a 100644
--- a/.github/workflows/create-release-branch.yaml
+++ b/.github/workflows/create-release-branch.yaml
@@ -21,7 +21,7 @@ jobs:
   prepare-required-plugins:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       - name: Create the required-plugins file@
         continue-on-error: true
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:      
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/e2e-code-quality.yaml b/.github/workflows/e2e-code-quality.yaml
index b63ab3d519..bcf4548fc9 100644
--- a/.github/workflows/e2e-code-quality.yaml
+++ b/.github/workflows/e2e-code-quality.yaml
@@ -21,12 +21,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
diff --git a/.github/workflows/e2e-triage-agent.yaml b/.github/workflows/e2e-triage-agent.yaml
index f0f2aa26a3..4f6accf2e6 100644
--- a/.github/workflows/e2e-triage-agent.yaml
+++ b/.github/workflows/e2e-triage-agent.yaml
@@ -115,7 +115,7 @@ jobs:
       - name: Generate GitHub App token
         if: steps.discover.outputs.should_file == 'true' && (inputs.dry_run || 'false') != 'true'
         id: generate-token
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.RHDH_GITHUB_APP_ID }}
           private-key: ${{ secrets.RHDH_GITHUB_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/generate-catalog-index.yaml b/.github/workflows/generate-catalog-index.yaml
index cc6983d1e5..025b198970 100644
--- a/.github/workflows/generate-catalog-index.yaml
+++ b/.github/workflows/generate-catalog-index.yaml
@@ -71,7 +71,7 @@ jobs:
           echo "Target branch: $TARGET_BRANCH"
 
       - name: Checkout source branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.branches.outputs.source-branch }}
           fetch-depth: 0
@@ -93,7 +93,7 @@ jobs:
           fi
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
@@ -307,7 +307,7 @@ jobs:
 
     steps:
       - name: Checkout (for Dockerfile)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.generate.outputs.source-branch }}
           sparse-checkout: |
@@ -360,7 +360,7 @@ jobs:
 
     steps:
       - name: Checkout (for Dockerfile)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.generate.outputs.source-branch }}
           sparse-checkout: |
@@ -414,13 +414,13 @@ jobs:
 
     steps:
       - name: Checkout catalog-index branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.generate.outputs.target-branch }}
           fetch-depth: 1
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
@@ -531,7 +531,7 @@ jobs:
       - name: Checkout wiki
         id: wiki-checkout
         continue-on-error: true
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}.wiki
           path: wiki
diff --git a/.github/workflows/label-mandatory-workspace-prs.yaml b/.github/workflows/label-mandatory-workspace-prs.yaml
index c99a12e791..f07b76decf 100644
--- a/.github/workflows/label-mandatory-workspace-prs.yaml
+++ b/.github/workflows/label-mandatory-workspace-prs.yaml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Label PRs based on workspace changes
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/native-smoke.yaml b/.github/workflows/native-smoke.yaml
index 2bc9f2a127..a04d069379 100644
--- a/.github/workflows/native-smoke.yaml
+++ b/.github/workflows/native-smoke.yaml
@@ -69,7 +69,7 @@ jobs:
         working-directory: smoke-tests-native
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -78,7 +78,7 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
diff --git a/.github/workflows/nfs-readiness-report.yaml b/.github/workflows/nfs-readiness-report.yaml
index 1e0b63af8f..6c18aa4eb0 100644
--- a/.github/workflows/nfs-readiness-report.yaml
+++ b/.github/workflows/nfs-readiness-report.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install oras
         env:
@@ -62,7 +62,7 @@ jobs:
 
     steps:
       - name: Checkout wiki
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}.wiki
           path: wiki
diff --git a/.github/workflows/pr-actions.yaml b/.github/workflows/pr-actions.yaml
index 74a65a6719..4657057125 100644
--- a/.github/workflows/pr-actions.yaml
+++ b/.github/workflows/pr-actions.yaml
@@ -579,7 +579,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Override Backstage compatibility
         id: override
diff --git a/.github/workflows/publish-coverage-upstream.yaml b/.github/workflows/publish-coverage-upstream.yaml
index 8db92de1cd..d0db702e3e 100644
--- a/.github/workflows/publish-coverage-upstream.yaml
+++ b/.github/workflows/publish-coverage-upstream.yaml
@@ -113,12 +113,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
 
diff --git a/.github/workflows/refresh-coverage-snapshot.yaml b/.github/workflows/refresh-coverage-snapshot.yaml
index 128db0d272..af29b44a23 100644
--- a/.github/workflows/refresh-coverage-snapshot.yaml
+++ b/.github/workflows/refresh-coverage-snapshot.yaml
@@ -85,7 +85,7 @@ jobs:
       # `require`-ing code the PR author wrote into a job holding a write token,
       # which is the thing the fork guard further down exists to prevent.
       - name: Checkout the default branch for the comment parser
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           # Its own directory, so the PR-branch checkout below lands on a clean
@@ -156,7 +156,7 @@ jobs:
 
       - name: Checkout PR branch
         if: steps.parse.outputs.skip == 'false'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.parse.outputs.head_ref }}
           # Full history so the push-retry's `git rebase origin/<branch>` has a
@@ -166,7 +166,7 @@ jobs:
 
       - name: Setup Node
         if: steps.parse.outputs.skip == 'false'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
 
diff --git a/.github/workflows/refresh-stale-coverage-snapshots.yaml b/.github/workflows/refresh-stale-coverage-snapshots.yaml
index 12aa21a952..9f45fc3dcc 100644
--- a/.github/workflows/refresh-stale-coverage-snapshots.yaml
+++ b/.github/workflows/refresh-stale-coverage-snapshots.yaml
@@ -54,7 +54,7 @@ jobs:
       BRANCH: chore/refresh-coverage-snapshots
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # find-stale-snapshots.sh compares commit dates per path, which a
           # shallow clone cannot answer.
@@ -62,7 +62,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
 
diff --git a/.github/workflows/run-workspace-smoke-tests.yaml b/.github/workflows/run-workspace-smoke-tests.yaml
index 17f4fe7038..b29ade5d79 100644
--- a/.github/workflows/run-workspace-smoke-tests.yaml
+++ b/.github/workflows/run-workspace-smoke-tests.yaml
@@ -53,7 +53,7 @@ jobs:
           path: ./artifacts
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -295,7 +295,7 @@ jobs:
       result: ${{ steps.outcome.outputs.result }}
     steps:
       - name: Checkout (harness source)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -310,7 +310,7 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
diff --git a/.github/workflows/seed-coverage-main.yaml b/.github/workflows/seed-coverage-main.yaml
index 9421ad29f0..334b2cc10f 100644
--- a/.github/workflows/seed-coverage-main.yaml
+++ b/.github/workflows/seed-coverage-main.yaml
@@ -49,7 +49,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Seed coverage snapshots
         env:
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index f169a2363f..7ee500fa76 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-issue-stale: 30
diff --git a/.github/workflows/sync-user-guide-to-wiki.yaml b/.github/workflows/sync-user-guide-to-wiki.yaml
index 42b382fcc9..0ddb444c3a 100644
--- a/.github/workflows/sync-user-guide-to-wiki.yaml
+++ b/.github/workflows/sync-user-guide-to-wiki.yaml
@@ -22,12 +22,12 @@ jobs:
     
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
       
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
       
diff --git a/.github/workflows/update-plugins-repo-refs.yaml b/.github/workflows/update-plugins-repo-refs.yaml
index ed12c6604b..87ac8a154a 100644
--- a/.github/workflows/update-plugins-repo-refs.yaml
+++ b/.github/workflows/update-plugins-repo-refs.yaml
@@ -123,7 +123,7 @@ jobs:
       release-branch-pattern: ${{ steps.read-release-branch-pattern.outputs.RELEASE_BRANCH_PATTERN }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Read Regexps
         id: read-regexps
diff --git a/.github/workflows/update-prs-with-release-branch-commits.yaml b/.github/workflows/update-prs-with-release-branch-commits.yaml
index 0518b91b08..590e479a59 100644
--- a/.github/workflows/update-prs-with-release-branch-commits.yaml
+++ b/.github/workflows/update-prs-with-release-branch-commits.yaml
@@ -47,7 +47,7 @@ jobs:
       updated-pr-numbers: ${{ steps.update-prs.outputs.updated-pr-numbers }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: update-prs
         env:
diff --git a/.github/workflows/update-wiki.yml b/.github/workflows/update-wiki.yml
index 2d4ab83564..b3d75bc2a1 100644
--- a/.github/workflows/update-wiki.yml
+++ b/.github/workflows/update-wiki.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
 
@@ -57,7 +57,7 @@ jobs:
             await script({github, context, core, checkOciImages});
 
       - name: Checkout wiki repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}.wiki
           path: wiki
diff --git a/.github/workflows/validate-app-config-examples.yaml b/.github/workflows/validate-app-config-examples.yaml
index 1dae435c78..535d2c01d7 100644
--- a/.github/workflows/validate-app-config-examples.yaml
+++ b/.github/workflows/validate-app-config-examples.yaml
@@ -52,7 +52,7 @@ jobs:
         working-directory: scripts/validate-app-config-examples
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -63,7 +63,7 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
diff --git a/.github/workflows/validate-catalog-scripts.yaml b/.github/workflows/validate-catalog-scripts.yaml
index 2a35cb8c09..550875c416 100644
--- a/.github/workflows/validate-catalog-scripts.yaml
+++ b/.github/workflows/validate-catalog-scripts.yaml
@@ -33,10 +33,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/workspace-tests.yaml b/.github/workflows/workspace-tests.yaml
index fa4154afb8..07df745a8b 100644
--- a/.github/workflows/workspace-tests.yaml
+++ b/.github/workflows/workspace-tests.yaml
@@ -44,7 +44,7 @@ jobs:
     steps:
       - name: Download published-exports artifact for this PR
         if: inputs.workspace != '' && inputs.pr-number != ''
-        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
+        uses: dawidd6/action-download-artifact@57aa996fc1713cc1579039614f4645a7f4841fd4 # v23
         with:
           name: published-exports-pr-${{ inputs.pr-number }}
           workflow: pr-actions.yaml
@@ -134,7 +134,7 @@ jobs:
       missing-metadata-plugins: ${{ steps.build-dynamic-plugins.outputs.missing-metadata-plugins }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.resolve.outputs.overlay-branch }}
           repository: ${{ needs.resolve.outputs.overlay-repo }}