diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 3fadea2f..ecb38fc9 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Generate token from GitHub App
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/docker-tests.yml b/.github/workflows/docker-tests.yml
index 5e9174a9..521b26ec 100644
--- a/.github/workflows/docker-tests.yml
+++ b/.github/workflows/docker-tests.yml
@@ -41,10 +41,10 @@ jobs:
       run: pip install requests
 
     - name: Install kubectl
-      uses: azure/setup-kubectl@v4
+      uses: azure/setup-kubectl@v5
 
     - name: Install Helm
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@v5
 
     - name: Install minikube
       uses: medyagh/setup-minikube@latest
@@ -79,17 +79,17 @@ jobs:
         echo "minor=$(echo $VERSION | cut -d. -f1-2)" >> $GITHUB_OUTPUT
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
 
     - name: Log in to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         username: blacklanternsecurity
         password: ${{ secrets.DOCKER_TOKEN }}
 
     - name: Extract metadata
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@v6
       with:
         images: blacklanternsecurity/bbot-server
         tags: |
@@ -101,7 +101,7 @@ jobs:
           type=raw,value=${{ steps.version.outputs.version }},enable=${{ github.ref == 'refs/heads/stable' }}
 
     - name: Build and push Docker image
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@v7
       with:
         context: .
         push: true
@@ -160,7 +160,7 @@ jobs:
         echo "version=$VERSION" >> $GITHUB_OUTPUT
 
     - name: Install Helm
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@v5
 
     - name: Update Chart.yaml version and appVersion
       run: |
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 322ccf4f..d5ec5b25 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -42,7 +42,7 @@ jobs:
         run: |
           NO_COLOR=true uv run pytest --reruns 2 --disable-warnings --log-cli-level=INFO --cov-report xml:cov.xml --cov=bbot_server .
       - name: Upload Code Coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./cov.xml
@@ -66,7 +66,7 @@ jobs:
       - name: Build PyPI package
         run: uv build
       - name: Publish PyPI package
-        uses: pypa/gh-action-pypi-publish@release/v1.13
+        uses: pypa/gh-action-pypi-publish@release/v1.14
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
     outputs: