diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 88a777329..6c88f2db3 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -39,7 +39,7 @@ jobs:
           - minimal
           - full
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Only fetch files we actually need:
           fetch-depth: 0
@@ -51,7 +51,7 @@ jobs:
           node-version: "20" # FIXME: this is very old and out-of-date. Bump the version!
 
       - name: Use cached ~/.npm
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -65,7 +65,7 @@ jobs:
         run: npm run preprocess-${{ matrix.variant }}
 
       - name: Cache Docusaurus build
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ github.workspace }}/.docusaurus
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index 42af10ae4..84f59bb24 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Check out repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Only fetch files we actually need:
           fetch-depth: 0
@@ -44,7 +44,7 @@ jobs:
           node-version: "20" # FIXME: this is very old and out-of-date. Bump the version!
 
       - name: Cache ~/.npm
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -57,7 +57,7 @@ jobs:
         run: npm run preprocess-full
 
       - name: Cache Docusaurus build
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ github.workspace }}/.docusaurus
diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
index c954ead1c..3e272216c 100644
--- a/.github/workflows/deploy-prod.yml
+++ b/.github/workflows/deploy-prod.yml
@@ -23,7 +23,7 @@ jobs:
       url: https://github.com/${{ env.TARGET_REPO }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_CHANNEL }}
 
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index a51f4d3e9..9767d36e6 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -23,7 +23,7 @@ jobs:
       url: https://github.com/${{ env.TARGET_REPO }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ env.RELEASE_CHANNEL }}
 
diff --git a/.github/workflows/generate-pdfs.yml b/.github/workflows/generate-pdfs.yml
index 4cf2ca7a9..f6474ccb2 100644
--- a/.github/workflows/generate-pdfs.yml
+++ b/.github/workflows/generate-pdfs.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
diff --git a/.github/workflows/release-channel-dev.yml b/.github/workflows/release-channel-dev.yml
index ab568b84f..73cfbab91 100644
--- a/.github/workflows/release-channel-dev.yml
+++ b/.github/workflows/release-channel-dev.yml
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release-channel-prod.yml b/.github/workflows/release-channel-prod.yml
index 87557d4aa..75dd1286c 100644
--- a/.github/workflows/release-channel-prod.yml
+++ b/.github/workflows/release-channel-prod.yml
@@ -11,21 +11,21 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: lewagon/wait-on-check-action@v1.7.0
+      - uses: lewagon/wait-on-check-action@v1.8.0
         with:
           ref: ${{ github.ref }}
           check-name: 'build (full)'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           wait-interval: 10
 
-      - uses: lewagon/wait-on-check-action@v1.7.0
+      - uses: lewagon/wait-on-check-action@v1.8.0
         with:
           ref: ${{ github.ref }}
           check-name: 'deploy'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           wait-interval: 10
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release-channel-staging.yml b/.github/workflows/release-channel-staging.yml
index f9cd06bbc..9b93f0693 100644
--- a/.github/workflows/release-channel-staging.yml
+++ b/.github/workflows/release-channel-staging.yml
@@ -14,21 +14,21 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: lewagon/wait-on-check-action@v1.7.0
+      - uses: lewagon/wait-on-check-action@v1.8.0
         with:
           ref: ${{ github.ref }}
           check-name: 'build (full)'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           wait-interval: 10
 
-      - uses: lewagon/wait-on-check-action@v1.7.0
+      - uses: lewagon/wait-on-check-action@v1.8.0
         with:
           ref: ${{ github.ref }}
           check-name: 'deploy'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           wait-interval: 10
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0