diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 217ec38a1..e5439ec9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,18 +45,18 @@ jobs:
 
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Set up Python ${{ matrix.pyver }}
-            uses: actions/setup-python@v6
+            uses: actions/setup-python@v6.2.0
             with:
               python-version: ${{ matrix.pyver }}
 
           - name: Install Go
-            uses: actions/setup-go@v6
+            uses: actions/setup-go@v6.4.0
             with:
               go-version-file: go.mod
 
@@ -73,7 +73,7 @@ jobs:
             CFLAGS: -funsigned-char
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 0  # needed for :commit: docs role
               persist-credentials: false
@@ -85,18 +85,18 @@ jobs:
             run: if grep -Inr ':code:`\s' kitty kitty_tests kittens docs *.py *.asciidoc *.rst *.go .gitattributes .gitignore; then echo Space at code block start found, aborting.; exit 1; fi
 
           - name: Set up Python
-            uses: actions/setup-python@v6
+            uses: actions/setup-python@v6.2.0
             with:
               python-version: "3.14"
 
           - name: Install Go
-            uses: actions/setup-go@v6
+            uses: actions/setup-go@v6.4.0
             with:
               go-version-file: go.mod
               cache: false
 
           - name: Cache Go build artifacts separately
-            uses: actions/cache@v5
+            uses: actions/cache@v5.0.5
             with:
               path: |
                 ~/.cache/go-build
@@ -143,13 +143,13 @@ jobs:
             KITTY_SANITIZE: 1
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Install Go
-            uses: actions/setup-go@v6
+            uses: actions/setup-go@v6.4.0
             with:
               go-version-file: go.mod
 
@@ -164,18 +164,18 @@ jobs:
         runs-on: macos-latest
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 0  # needed for :commit: docs role
               persist-credentials: false
 
           - name: Set up Python
-            uses: actions/setup-python@v6
+            uses: actions/setup-python@v6.2.0
             with:
               python-version: "3.14"
 
           - name: Install Go
-            uses: actions/setup-go@v6
+            uses: actions/setup-go@v6.4.0
             with:
               go-version-file: go.mod
 
@@ -202,7 +202,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 10
               persist-credentials: false
@@ -211,7 +211,7 @@ jobs:
             run: sudo apt-get update && sudo apt-get install -y curl xz-utils build-essential git pkg-config libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libgl1-mesa-dev libxkbcommon-x11-dev libfontconfig-dev libx11-xcb-dev libdbus-1-dev
 
           - name: Install Go
-            uses: actions/setup-go@v6
+            uses: actions/setup-go@v6.4.0
             with:
               go-version-file: go.mod
 
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 3b588329f..4e4bdd4bf 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
         steps:
 
         - name: Checkout repository
-          uses: actions/checkout@v6.0.3
+          uses: actions/checkout@v7.0.0
           with:
               # We must fetch at least the immediate parents so that if this is
               # a pull request then we can checkout the head.
@@ -48,7 +48,7 @@ jobs:
 
         - name: Install Go
           if: matrix.language == 'c' || matrix.language == 'go'
-          uses: actions/setup-go@v6
+          uses: actions/setup-go@v6.4.0
           with:
               go-version-file: go.mod
 
diff --git a/.github/workflows/depscan.yml b/.github/workflows/depscan.yml
index b9476a6e9..ad3273f62 100644
--- a/.github/workflows/depscan.yml
+++ b/.github/workflows/depscan.yml
@@ -22,13 +22,13 @@ jobs:
             KITTY_BUNDLE: 1
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Checkout bypy
-            uses: actions/checkout@v6.0.3
+            uses: actions/checkout@v7.0.0
             with:
               fetch-depth: 1
               persist-credentials: false