diff --git a/.github/workflows/_required.yml b/.github/workflows/_required.yml
index 426a6e2..0cc2bc6 100644
--- a/.github/workflows/_required.yml
+++ b/.github/workflows/_required.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Reject silent-failure workaround in shell/YAML/Dockerfile/justfile/HCL"
         run: |
@@ -306,7 +306,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@6b51ade7a9e4a75a7ad929842dd298a3804ebe8b  # v20.0.0
+        uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd  # v20.0.0
         with:
           globs: |
             **/*.md
@@ -765,7 +765,7 @@ jobs:
 
       - name: Supply-chain review (PR only)
         if: github.event_name == 'pull_request'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: critical
           deny-licenses: GPL-3.0, AGPL-3.0
diff --git a/.github/workflows/extras.yml b/.github/workflows/extras.yml
index db8cd2a..366001a 100644
--- a/.github/workflows/extras.yml
+++ b/.github/workflows/extras.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
 
       - name: Install build dependencies
         uses: ./.github/actions/install-build-deps
@@ -90,7 +90,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
 
       - name: Install build dependencies
         uses: ./.github/actions/install-build-deps
@@ -156,7 +156,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
 
       - name: Install build dependencies
         uses: ./.github/actions/install-build-deps
diff --git a/.github/workflows/profiling-weekly.yml b/.github/workflows/profiling-weekly.yml
index 34a927a..15036da 100644
--- a/.github/workflows/profiling-weekly.yml
+++ b/.github/workflows/profiling-weekly.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
 
       - name: Install build dependencies
         uses: ./.github/actions/install-build-deps
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e8d2439..ea3d3d3 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout release tag
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}