diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 4c9c7801a02a..ec1428548121 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -60,7 +60,7 @@ jobs:
           persist-credentials: false
           
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: 'go.mod'
           
diff --git a/.github/workflows/deploy_dev_docs_to_cf.yaml b/.github/workflows/deploy_dev_docs_to_cf.yaml
index 9bf8de2dd94c..d99721cf3af4 100644
--- a/.github/workflows/deploy_dev_docs_to_cf.yaml
+++ b/.github/workflows/deploy_dev_docs_to_cf.yaml
@@ -54,12 +54,12 @@ jobs:
           extended: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
 
       - name: Cache dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
diff --git a/.github/workflows/deploy_previous_version_docs_to_cf.yaml b/.github/workflows/deploy_previous_version_docs_to_cf.yaml
index 57e816d05d1f..1f2a9d856620 100644
--- a/.github/workflows/deploy_previous_version_docs_to_cf.yaml
+++ b/.github/workflows/deploy_previous_version_docs_to_cf.yaml
@@ -60,7 +60,7 @@ jobs:
           extended: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/deploy_versioned_docs_to_cf.yaml b/.github/workflows/deploy_versioned_docs_to_cf.yaml
index f5b183d03c62..2a68354ff7c3 100644
--- a/.github/workflows/deploy_versioned_docs_to_cf.yaml
+++ b/.github/workflows/deploy_versioned_docs_to_cf.yaml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout cloudflare-pages branch for pruning
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: cloudflare-pages
           path: cf-pages-branch
@@ -102,7 +102,7 @@ jobs:
       - name: Setup Node
         # zizmor flags setup-node for cache-poisoning on releases, but since we don't pass `cache: npm`, no caching occurs. Safe to ignore.
         # zizmor: ignore[cache-poisoning]
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/docs_lint.yaml b/.github/workflows/docs_lint.yaml
index eccb35e0a7f9..04a293d2540c 100644
--- a/.github/workflows/docs_lint.yaml
+++ b/.github/workflows/docs_lint.yaml
@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.x'
 
diff --git a/.github/workflows/docs_preview_build_cf.yaml b/.github/workflows/docs_preview_build_cf.yaml
index 5ca439e193d9..93fd5fc250e1 100644
--- a/.github/workflows/docs_preview_build_cf.yaml
+++ b/.github/workflows/docs_preview_build_cf.yaml
@@ -53,7 +53,7 @@ jobs:
           extended: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
           cache: 'npm'
diff --git a/.github/workflows/link_checker.yaml b/.github/workflows/link_checker.yaml
index 3d3dbf7dc093..79fad32396f7 100644
--- a/.github/workflows/link_checker.yaml
+++ b/.github/workflows/link_checker.yaml
@@ -55,7 +55,7 @@ jobs:
 
       - name: Restore lychee cache
         if: steps.changed-files.outputs.HAS_CHANGES == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .lycheecache
           key: cache-lychee-${{ github.sha }}
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 3b53e01e1883..03ca75759fd4 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: 'go.mod'
 
diff --git a/.github/workflows/nightly_tier_report.yml b/.github/workflows/nightly_tier_report.yml
index 02e15b51e70a..69e8493fb9c7 100644
--- a/.github/workflows/nightly_tier_report.yml
+++ b/.github/workflows/nightly_tier_report.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: 'go.mod'
 
@@ -44,7 +44,7 @@ jobs:
           sleep 5 # Give the server a moment to bind to port 5000
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index a428b262ec0c..46fe045d0779 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -33,12 +33,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 41f1c0094cfe..76aecb9cc456 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: 'go.mod'
 
diff --git a/.github/workflows/update_release_docs_config.yml b/.github/workflows/update_release_docs_config.yml
index a17c76cbc899..5ce0ae198a94 100644
--- a/.github/workflows/update_release_docs_config.yml
+++ b/.github/workflows/update_release_docs_config.yml
@@ -36,14 +36,14 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please--') }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref || github.ref }}
           persist-credentials: true
 
       - name: Setup Python
-        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"