diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 82d1178d3..ac852304a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,18 +45,18 @@ jobs:
 
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Set up Python ${{ matrix.pyver }}
-            uses: actions/setup-python@v6.3.0
+            uses: actions/setup-python@v7.0.0
             with:
               python-version: ${{ matrix.pyver }}
 
           - name: Install Go
-            uses: actions/setup-go@v6.5.0
+            uses: actions/setup-go@v7.0.0
             with:
               go-version-file: go.mod
 
@@ -73,7 +73,7 @@ jobs:
             CFLAGS: -funsigned-char
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 0  # needed for :commit: docs role
               persist-credentials: false
@@ -85,12 +85,12 @@ jobs:
             run: if grep -Inr ':code:`\s' kitty kitty_tests kittens docs *.py *.asciidoc *.rst *.go .gitattributes .gitignore; then echo Space at code block start found, aborting.; exit 1; fi
 
           - name: Set up Python
-            uses: actions/setup-python@v6.3.0
+            uses: actions/setup-python@v7.0.0
             with:
               python-version: "3.14"
 
           - name: Install Go
-            uses: actions/setup-go@v6.5.0
+            uses: actions/setup-go@v7.0.0
             with:
               go-version-file: go.mod
               cache: false
@@ -143,13 +143,13 @@ jobs:
             KITTY_SANITIZE: 1
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Install Go
-            uses: actions/setup-go@v6.5.0
+            uses: actions/setup-go@v7.0.0
             with:
               go-version-file: go.mod
 
@@ -164,18 +164,18 @@ jobs:
         runs-on: macos-latest
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 0  # needed for :commit: docs role
               persist-credentials: false
 
           - name: Set up Python
-            uses: actions/setup-python@v6.3.0
+            uses: actions/setup-python@v7.0.0
             with:
               python-version: "3.14"
 
           - name: Install Go
-            uses: actions/setup-go@v6.5.0
+            uses: actions/setup-go@v7.0.0
             with:
               go-version-file: go.mod
 
@@ -202,7 +202,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 10
               persist-credentials: false
@@ -211,7 +211,7 @@ jobs:
             run: sudo apt-get update && sudo apt-get install -y curl xz-utils build-essential git pkg-config libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libgl1-mesa-dev libxkbcommon-x11-dev libfontconfig-dev libx11-xcb-dev libdbus-1-dev
 
           - name: Install Go
-            uses: actions/setup-go@v6.5.0
+            uses: actions/setup-go@v7.0.0
             with:
               go-version-file: go.mod
 
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 28b23b531..8288e0c78 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
         steps:
 
         - name: Checkout repository
-          uses: actions/checkout@v7.0.0
+          uses: actions/checkout@v7.0.1
           with:
               # We must fetch at least the immediate parents so that if this is
               # a pull request then we can checkout the head.
@@ -48,13 +48,13 @@ jobs:
 
         - name: Install Go
           if: matrix.language == 'c' || matrix.language == 'go'
-          uses: actions/setup-go@v6.5.0
+          uses: actions/setup-go@v7.0.0
           with:
               go-version-file: go.mod
 
         # Initializes the CodeQL tools for scanning.
         - name: Initialize CodeQL
-          uses: github/codeql-action/init@v4.37.0
+          uses: github/codeql-action/init@v4.37.1
           with:
               languages: ${{ matrix.language }}
               trap-caching: false
@@ -64,7 +64,7 @@ jobs:
           run: python3 .github/workflows/ci.py build
 
         - name: Perform CodeQL Analysis
-          uses: github/codeql-action/analyze@v4.37.0
+          uses: github/codeql-action/analyze@v4.37.1
 
         - name: Run govulncheck
           if: matrix.language == 'go'
diff --git a/.github/workflows/depscan.yml b/.github/workflows/depscan.yml
index ad3273f62..94e95fb11 100644
--- a/.github/workflows/depscan.yml
+++ b/.github/workflows/depscan.yml
@@ -22,13 +22,13 @@ jobs:
             KITTY_BUNDLE: 1
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Checkout bypy
-            uses: actions/checkout@v7.0.0
+            uses: actions/checkout@v7.0.1
             with:
               fetch-depth: 1
               persist-credentials: false