diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 2b2efb1..403d0c4 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -45,7 +45,7 @@ jobs:
           echo "coverage files: $files"
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         with:
           files: ${{ steps.locate.outputs.files }}
           fail_ci_if_error: false
diff --git a/.github/workflows/labels-sync.yml b/.github/workflows/labels-sync.yml
index b73bc97..0769650 100644
--- a/.github/workflows/labels-sync.yml
+++ b/.github/workflows/labels-sync.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: crazy-max/ghaction-github-labeler@v5
+      - uses: crazy-max/ghaction-github-labeler@v6
         with:
           yaml-file: .github/labels.yml
           # Don't delete labels the manifest doesn't mention; the
diff --git a/.github/workflows/manifest-validate.yml b/.github/workflows/manifest-validate.yml
index 885a83f..c98209e 100644
--- a/.github/workflows/manifest-validate.yml
+++ b/.github/workflows/manifest-validate.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index bc1427a..3188150 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -12,6 +12,6 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6
         with:
           configuration-path: .github/labeler.yml
diff --git a/.github/workflows/python-binding.yml b/.github/workflows/python-binding.yml
index 01bb940..0a1b693 100644
--- a/.github/workflows/python-binding.yml
+++ b/.github/workflows/python-binding.yml
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c1a0c31..e479139 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -118,7 +118,7 @@ jobs:
           echo "hashes=$HASHES" >> "$GITHUB_OUTPUT"
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-artifacts
           path: artifacts/
@@ -149,7 +149,7 @@ jobs:
           dotnet-version: 10.0.x
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: release-artifacts
           path: artifacts
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 185c601..9e16b44 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,7 +36,7 @@ jobs:
           publish_results: true
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: SARIF file
           path: results.sarif
diff --git a/.github/workflows/spec-validate.yml b/.github/workflows/spec-validate.yml
index 6c746a3..11e722d 100644
--- a/.github/workflows/spec-validate.yml
+++ b/.github/workflows/spec-validate.yml
@@ -34,7 +34,7 @@ jobs:
           ruby-version: "3.2"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"