diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3be436bcc0..80716c7aa8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,15 +26,15 @@ jobs:
         language: [go,javascript]
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     - if: matrix.language == 'go'
       name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version-file: go.mod
     - if: matrix.language == 'go'
       name: Set up pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@v5
     - name: Generate gRPC Stubs and Static Assets
       if: matrix.language == 'go'
       run: |
@@ -42,7 +42,7 @@ jobs:
         pnpm nx run-many --nxBail --projects @zitadel/api --targets generate-stubs generate-statik generate-assets
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: ${{ matrix.language }}
@@ -60,6 +60,6 @@ jobs:
     # autobuild does not work anymore
     # and to be able to compile without an actual console build, we just need a placeholder in the console dist folder
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 5b1febf989..480c3392bc 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: add issue
-        uses: actions/add-to-project@v1.0.1
+        uses: actions/add-to-project@v1.0.2
         if: ${{ github.event_name == 'issues' }}
         with:
           # You can target a repository in a different organization
@@ -28,7 +28,7 @@ jobs:
          username: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.ADD_TO_PROJECT_PAT }}
       - name: add pr
-        uses: actions/add-to-project@v1.0.1
+        uses: actions/add-to-project@v1.0.2
         if: ${{ github.event_name == 'pull_request_target' && github.actor != 'dependabot[bot]' && !contains(steps.checkUserMember.outputs.teams, 'engineers')}}
         with:
           # You can target a repository in a different organization
diff --git a/.github/workflows/lint_test_build.yml b/.github/workflows/lint_test_build.yml
index 9bc2efca19..d32ae981b9 100644
--- a/.github/workflows/lint_test_build.yml
+++ b/.github/workflows/lint_test_build.yml
@@ -22,7 +22,7 @@ jobs:
     environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           filter: tree:0
@@ -30,28 +30,28 @@ jobs:
         if: ${{ github.ref != 'refs/heads/main' }}
         run: git fetch origin main:main
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go_version }}
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
         with:
           run_install: false
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ inputs.node_version }}
           cache: "pnpm"
       - name: Set up Docker
-        uses: docker/setup-docker-action@v4
+        uses: docker/setup-docker-action@v5
         with:
           version: v28.3.2
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: v0.28.0
       - name: Set up Docker Compose
-        uses: docker/setup-compose-action@v1
+        uses: docker/setup-compose-action@v2
         with:
           version: v2.38.2
       - name: Install dependencies
@@ -60,7 +60,7 @@ jobs:
         run: pnpm cypress install
         working-directory: apps/login
       - name: Set SHAs for nx affected commands
-        uses: nrwl/nx-set-shas@v4
+        uses: nrwl/nx-set-shas@v5
       - name: Lint, Test and Build
         env:
           NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
@@ -71,14 +71,14 @@ jobs:
           NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
         run: pnpm nx fix-ci
       - name: Publish API Unit Test Coverage
-        uses: codecov/codecov-action@v4.3.0
+        uses: codecov/codecov-action@v5.5.3
         with:
           file: profile.api.test-unit.cov
           name: api-test-unit
           flags: api-test-unit
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Publish API Integration Test Coverage
-        uses: codecov/codecov-action@v4.3.0
+        uses: codecov/codecov-action@v5.5.3
         with:
           file: profile.api.test-integration.cov
           name: api-test-integration
@@ -86,13 +86,13 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload API Integration Test Race Logs
         if: failure() || cancelled()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: api-integration-test-race-logs
           path: |
            .artifacts/api-test-integration/race.log.*
       - name: Upload Functional UI Test Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure() || cancelled()
         with:
           name: functional-ui-tests
diff --git a/.github/workflows/pack.yml b/.github/workflows/pack.yml
index fa64bb3516..4a74685e66 100644
--- a/.github/workflows/pack.yml
+++ b/.github/workflows/pack.yml
@@ -53,25 +53,25 @@ jobs:
       packages: write
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           filter: tree:0
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go_version }}
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
         with:
           run_install: false
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ inputs.node_version }}
           cache: "pnpm"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: v0.28.0
       - name: Install dependencies
@@ -87,29 +87,29 @@ jobs:
           NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
         run: pnpm nx fix-ci
       - name: Upload all platform archives
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: zitadel-archives
           path: .artifacts/pack
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Login to Docker registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Login to Google Artifact Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: europe-docker.pkg.dev
           username: _json_key_base64
           password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
       - name: Generate Standard Tags and Labels from the GitHub Context for the API Scratch Container Image
         id: scratch-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ inputs.image_name_github_api }}
@@ -119,7 +119,7 @@ jobs:
             type=sha,prefix=,suffix=,format=long
       - name: Build and Push the SHA-tagged API Scratch Container Image
         id: build-scratch
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         timeout-minutes: 3
         with:
           context: .
@@ -133,7 +133,7 @@ jobs:
           tags: ${{ steps.scratch-meta.outputs.tags }}
       - name: Generate Standard Tags and Labels from the GitHub Context for the API Debug Container Image
         id: debug-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ inputs.image_name_github_api }}
@@ -143,7 +143,7 @@ jobs:
             type=sha,prefix=,suffix=-debug,format=long
       - name: Build and Push the SHA-tagged API Debug Container Image
         id: build-debug
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         timeout-minutes: 5
         with:
           context: .
@@ -158,7 +158,7 @@ jobs:
           outputs: type=image,name=${{ inputs.image_name_github_api }},name-canonical=true
       - name: Generate Standard Tags and Labels from the GitHub Context for the Login Container Image
         id: login-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ inputs.image_name_github_login }}
@@ -170,7 +170,7 @@ jobs:
             type=sha,prefix=,suffix=,format=long
       - name: Build and Push the SHA-tagged Login Container Image
         id: build-login
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         timeout-minutes: 3
         with:
           context: apps/login
diff --git a/.github/workflows/ready_for_review.yml b/.github/workflows/ready_for_review.yml
index db756633f4..c7413d6e91 100644
--- a/.github/workflows/ready_for_review.yml
+++ b/.github/workflows/ready_for_review.yml
@@ -6,7 +6,7 @@ jobs:
   comment:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
         with:
           script: |
             const content = `### Thanks for your contribution @${{ github.event.pull_request.user.login }}! 🎉
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b68fb62a0a..052da5168d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Publish Release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -73,20 +73,20 @@ jobs:
     steps:
     -
       name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
     -
       name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
     - 
       name: Login to Docker registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
     -
       name: Login to Google Artifact Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         registry: europe-docker.pkg.dev
         username: _json_key_base64
@@ -170,15 +170,15 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
 
       - name: Install dependencies
         working-directory: login
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 380624521f..61af6113e0 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -26,17 +26,17 @@ jobs:
     steps:
     -
       name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
     -
       name: Download Artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       if: ${{ !inputs.dry_run }}
       with:
         name: zitadel-archives
         path: .artifacts/pack
     -
       name: Run Semantic Release
-      uses: cycjimmy/semantic-release-action@v4
+      uses: cycjimmy/semantic-release-action@v6
       id: semantic
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}