diff --git a/.github/workflows/build-runner.yaml b/.github/workflows/build-runner.yaml
index e18cd8e67..dfb798a45 100644
--- a/.github/workflows/build-runner.yaml
+++ b/.github/workflows/build-runner.yaml
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "🔧 Login to GitHub Container Registry"
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -39,7 +39,7 @@ jobs:
         shell: bash
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: ./docker
           file: ./docker/runner.Dockerfile
diff --git a/.github/workflows/clean-bazel-caches.yaml b/.github/workflows/clean-bazel-caches.yaml
index fbfc8cb0c..5aaed475d 100644
--- a/.github/workflows/clean-bazel-caches.yaml
+++ b/.github/workflows/clean-bazel-caches.yaml
@@ -18,7 +18,7 @@ jobs:
       matrix:
         runner: [1, 2, 3, 4] # We currently have 4 runners, adjust this number if more runners are added
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/dashboard.yaml b/.github/workflows/dashboard.yaml
index b46eef67a..30e93f629 100644
--- a/.github/workflows/dashboard.yaml
+++ b/.github/workflows/dashboard.yaml
@@ -21,13 +21,13 @@ jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "🚀 Building"
         run: |
           docker build -t ghcr.io/dfinity/dre/ic-management-frontend:$GITHUB_SHA -f dashboard/Dockerfile dashboard
 
       - name: "🔧 Login to GitHub Container Registry"
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/dre-release.yaml b/.github/workflows/dre-release.yaml
index aad49ef0f..af0cb3258 100644
--- a/.github/workflows/dre-release.yaml
+++ b/.github/workflows/dre-release.yaml
@@ -14,7 +14,7 @@ jobs:
       labels: dre-runner-custom
     container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "☁️ Setup runner"
         uses: ./.github/workflows/manage-runner-pre
@@ -31,7 +31,7 @@ jobs:
     needs: [test]
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -79,7 +79,7 @@ jobs:
           cargo build --release -p dre --target aarch64-apple-darwin
 
       - name: Upload macOS aarch64 artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dre-aarch64-apple-darwin
           path: target/aarch64-apple-darwin/release/dre
@@ -97,7 +97,7 @@ jobs:
           cargo build --release -p dre --target x86_64-apple-darwin
 
       - name: Upload macOS x86_64 artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dre-x86_64-apple-darwin
           path: target/x86_64-apple-darwin/release/dre
@@ -113,7 +113,7 @@ jobs:
       packages: write
       pages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-tags: true
           fetch-depth: 0
@@ -125,7 +125,7 @@ jobs:
       # If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
       # https://github.com/orgs/community/discussions/25702
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
@@ -158,7 +158,7 @@ jobs:
           cp --dereference bazel-out/k8-opt/bin/rs/cli/dre release/artifacts/dre-x86_64-unknown-linux
 
       - name: Download macOS x86_64 artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dre-x86_64-apple-darwin
           path: release/artifacts/
@@ -168,7 +168,7 @@ jobs:
         run: mv release/artifacts/dre release/artifacts/dre-x86_64-apple-darwin
 
       - name: Download macOS aarch64 artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dre-aarch64-apple-darwin
           path: release/artifacts/
@@ -184,7 +184,7 @@ jobs:
 
       - name: "🆕 📢 Prepare release"
         # v0.1.15
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -202,7 +202,7 @@ jobs:
           rm -rf release
 
       - name: "🆕 Create a new Pull Request with the changes"
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           commit-message: "chore(release): New release of `dre` version ${{ steps.tag.outputs.tag }}"
           branch: bot-release-${{ steps.tag.outputs.tag }}
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index bd549a654..30b9f14a0 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -37,7 +37,7 @@ jobs:
       packages: write
       pages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
@@ -45,7 +45,7 @@ jobs:
       # If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
       # https://github.com/orgs/community/discussions/25702
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
@@ -85,7 +85,7 @@ jobs:
 
       - name: "🧪 Upload test artifacts"
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-artifacts
           path: bazel-out/k8-opt/bin/rs/ic-observability/multiservice-discovery/multiservice-discovery
diff --git a/.github/workflows/msd-diff.yaml b/.github/workflows/msd-diff.yaml
index 050ea2c2b..d29e816e7 100644
--- a/.github/workflows/msd-diff.yaml
+++ b/.github/workflows/msd-diff.yaml
@@ -19,7 +19,7 @@ jobs:
     # This image is based on ubuntu:20.04
     container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
@@ -27,7 +27,7 @@ jobs:
         uses: ./.github/workflows/manage-runner-pre
 
       - name: "📥 Download main test artifact"
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@v20
         with:
           name: test-artifacts
           branch: main
@@ -57,7 +57,7 @@ jobs:
           echo "targets_main=$TARGETS_DIR_MAIN" >> $GITHUB_OUTPUT
           echo "targets_branch=$TARGETS_DIR_BRANCH" >> $GITHUB_OUTPUT
       - name: "Check MSD Diff"
-        uses: "int128/diff-action@v1"
+        uses: "int128/diff-action@v2"
         with:
           base: ${{ steps.msd-diff.outputs.targets_main }}
           head: ${{ steps.msd-diff.outputs.targets_branch }}
diff --git a/.github/workflows/pull-request-update.yaml b/.github/workflows/pull-request-update.yaml
index aa57858d2..20262e829 100644
--- a/.github/workflows/pull-request-update.yaml
+++ b/.github/workflows/pull-request-update.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
diff --git a/.github/workflows/release-controller.yaml b/.github/workflows/release-controller.yaml
index be3b8915a..ad8acfbdf 100644
--- a/.github/workflows/release-controller.yaml
+++ b/.github/workflows/release-controller.yaml
@@ -42,7 +42,7 @@ jobs:
       packages: write
       pages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
@@ -50,7 +50,7 @@ jobs:
       # If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
       # https://github.com/orgs/community/discussions/25702
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 187add890..7a299ea5a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
     container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
     name: Check changed release index files
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Run checks for release index
         run: |
           rye sync
diff --git a/.github/workflows/required-checks.yaml b/.github/workflows/required-checks.yaml
index fb18205f0..90429eafe 100644
--- a/.github/workflows/required-checks.yaml
+++ b/.github/workflows/required-checks.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Wait for running jobs
-        uses: lewagon/wait-on-check-action@v1.3.4
+        uses: lewagon/wait-on-check-action@v1.6.0
         with:
           ref: ${{ github.ref }}
           running-workflow-name: Wait for required jobs to complete or be skipped
diff --git a/.github/workflows/trusted-neurons-alerts.yaml b/.github/workflows/trusted-neurons-alerts.yaml
index 1fc097c62..3707ef712 100644
--- a/.github/workflows/trusted-neurons-alerts.yaml
+++ b/.github/workflows/trusted-neurons-alerts.yaml
@@ -38,7 +38,7 @@ jobs:
       packages: write
       pages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
@@ -46,7 +46,7 @@ jobs:
       # If regular secrets.GITHUB_TOKEN is used instead, the push will not trigger any actions
       # https://github.com/orgs/community/discussions/25702
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
diff --git a/.github/workflows/update-dependencies.yaml b/.github/workflows/update-dependencies.yaml
index affb6f516..1f4a165c0 100644
--- a/.github/workflows/update-dependencies.yaml
+++ b/.github/workflows/update-dependencies.yaml
@@ -11,12 +11,12 @@ jobs:
     container: ghcr.io/dfinity/dre/actions-runner:6413f2909a49329ecbf5371ee7ddf07a9799b625
     steps:
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ vars.PR_AUTOMATION_BOT_PUBLIC_APP_ID }}
           private-key: ${{ secrets.PR_AUTOMATION_BOT_PUBLIC_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: "🔧 Setup runner"
         uses: ./.github/workflows/manage-runner-pre
 
@@ -57,7 +57,7 @@ jobs:
           ./bin/release-controller-update-data-model.sh
 
       - name: "🆕 Create a new Pull Request with the changes"
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           commit-message: "chore(deps): Update dependencies"
           branch: bot-update-deps