diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2eb3028564..8bb7db0864 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,11 +20,11 @@ jobs:
         env:
           REPO: '${{ github.repository }}'
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
       - name: Github Container Login
         uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
         with:
@@ -32,7 +32,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -42,7 +42,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.REPO_LOWER }}/hyrax-base:${{ env.TAG }}
             ${{ env.REGISTRY }}/${{ env.REPO_LOWER }}/hyrax-base:${{ github.ref_name }}
       - name: Build and push worker
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -54,7 +54,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.REPO_LOWER }}/hyrax-worker-base:${{ env.TAG }}
             ${{ env.REGISTRY }}/${{ env.REPO_LOWER }}/hyrax-worker-base:${{ github.ref_name }}
       - name: Build and push dassie
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -66,7 +66,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.REPO_LOWER }}/dassie:${{ env.TAG }}
             ${{ env.REGISTRY }}/${{ env.REPO_LOWER }}/dassie:${{ github.ref_name }}
       - name: Build and push dassie worker
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml
index 85ce49e82d..ff35fbb282 100644
--- a/.github/workflows/lint-build-test.yml
+++ b/.github/workflows/lint-build-test.yml
@@ -29,7 +29,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.3'
@@ -38,7 +38,7 @@ jobs:
       - name: Rubocop
         run: bundle install && bundle exec rubocop --parallel --format progress --format junit --out rubocop.xml --display-only-failed
       - name: Archive rubocop reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: rubocop-reports
@@ -51,18 +51,18 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Auth to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Setup image tags
         id: image-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -70,7 +70,7 @@ jobs:
             type=ref,event=pr
             type=sha,format=long,prefix=
       - name: Build and export
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           build-args: |
             BUILD_TIMESTAMP=${{ fromJSON(steps.image-meta.outputs.json).labels['org.opencontainers.image.created'] }}
@@ -84,7 +84,7 @@ jobs:
           labels: ${{ steps.image-meta.outputs.labels }}
           outputs: type=docker,dest=${{runner.temp}}/hyrax-dev-${{ github.sha }}.tar
       - name: Trigger Nurax Deployment
-        uses: peter-evans/repository-dispatch@v3
+        uses: peter-evans/repository-dispatch@v4
         if: ${{ github.ref == 'refs/heads/main' }}
         with:
           token: ${{ secrets.NURAX_ACCESS_TOKEN }}
@@ -92,7 +92,7 @@ jobs:
           repository: samvera-labs/nurax-terraform
           client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}"}'
       - name: Upload built image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: hyrax-dev
           path: ${{runner.temp}}/hyrax-dev-${{ github.sha }}.tar
@@ -108,7 +108,7 @@ jobs:
         ci_node_index: [0,1,2,3]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup tmate debug session
         uses: mxschmitt/action-tmate@v3
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
@@ -116,7 +116,7 @@ jobs:
           limit-access-to-actor: true
           detached: true
       - name: Download built image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: hyrax-dev
           path: ${{runner.temp}}
@@ -146,7 +146,7 @@ jobs:
         run: >-
           mv rspec.xml rspec-${CI_TEST_APP}-${CI_NODE_INDEX}.xml
       - name: Archive spec reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: spec-reports-${{ matrix.ci_test_app }}-${{ matrix.ci_node_index }}
@@ -157,7 +157,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Upload
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: Event File
         path: ${{ github.event_path }}
diff --git a/.github/workflows/release-charts.yml b/.github/workflows/release-charts.yml
index 2ad4c5576b..fc7db4d027 100644
--- a/.github/workflows/release-charts.yml
+++ b/.github/workflows/release-charts.yml
@@ -27,7 +27,7 @@ jobs:
           detached: true
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/test-results.yml b/.github/workflows/test-results.yml
index 85606861ca..104e9f75d5 100644
--- a/.github/workflows/test-results.yml
+++ b/.github/workflows/test-results.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Download and Extract Artifacts
-        uses: dawidd6/action-download-artifact@e7466d1a7587ed14867642c2ca74b5bcc1e19a2d
+        uses: dawidd6/action-download-artifact@v21
         with:
           run_id: ${{ github.event.workflow_run.id }}
           path: artifacts