diff --git a/.github/workflows/build-devcontainer.yml b/.github/workflows/build-devcontainer.yml
index 6e78cd9..553b271 100644
--- a/.github/workflows/build-devcontainer.yml
+++ b/.github/workflows/build-devcontainer.yml
@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Validate devcontainer.json syntax
         run: just devcontainer-validate
@@ -42,7 +42,7 @@ jobs:
     
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -77,7 +77,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
       
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: digests-${{ matrix.os }}-${{ matrix.arch }}
           path: /tmp/digests/*
@@ -93,7 +93,7 @@ jobs:
         os: [debian, c10s]
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: /tmp/digests
           pattern: digests-${{ matrix.os }}-*
diff --git a/.github/workflows/container-gc.yml b/.github/workflows/container-gc.yml
index c7d1220..f2c148a 100644
--- a/.github/workflows/container-gc.yml
+++ b/.github/workflows/container-gc.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Delete old container images
-        uses: snok/container-retention-policy@v3.0.0
+        uses: snok/container-retention-policy@v3.0.1
         with:
           account: ${{ github.repository_owner }}
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 13c0b48..4fc7a08 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Validate Renovate config
-        uses: renovatebot/github-action@v43.0.10
+        uses: renovatebot/github-action@v44.2.0
         env:
           RENOVATE_DRY_RUN: lookup
           LOG_LEVEL: debug
@@ -44,10 +44,10 @@ jobs:
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v43.0.10
+        uses: renovatebot/github-action@v44.2.0
         env:
           RENOVATE_DRY_RUN: ${{ github.repository_owner != 'bootc-dev' && 'full' }}
           LOG_LEVEL: ${{ github.event.inputs.log-level || 'info' }}
diff --git a/.github/workflows/sync-common.yml b/.github/workflows/sync-common.yml
index a202f5f..936b3ca 100644
--- a/.github/workflows/sync-common.yml
+++ b/.github/workflows/sync-common.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup Rust
         uses: ./common/.github/actions/setup-rust
@@ -35,7 +35,7 @@ jobs:
         run: cargo build --release --manifest-path scripts/sync-common/Cargo.toml
 
       - name: Upload sync-common binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: sync-common
           path: scripts/sync-common/target/release/sync-common
@@ -56,7 +56,7 @@ jobs:
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Get repository list
         id: get-repos
@@ -112,20 +112,20 @@ jobs:
           repositories: ${{ matrix.repo }}
 
       - name: Checkout infra repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           path: infra
           fetch-depth: 0
 
       - name: Checkout target repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           repository: ${{ matrix.full_name }}
           token: ${{ steps.token.outputs.token }}
           path: repo
 
       - name: Download sync-common binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: sync-common
           path: .
@@ -136,7 +136,7 @@ jobs:
           ./sync-common infra repo "${{ github.sha }}"
 
       - name: Open pull request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ steps.token.outputs.token }}
           path: repo
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 287f14c..869da65 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -28,7 +28,7 @@ jobs:
       labels: ${{ steps.parse-labels.outputs.labels }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Parse labels from TOML
         id: parse-labels
diff --git a/.github/workflows/test-bootc-ubuntu-setup.yml b/.github/workflows/test-bootc-ubuntu-setup.yml
index b456513..336546d 100644
--- a/.github/workflows/test-bootc-ubuntu-setup.yml
+++ b/.github/workflows/test-bootc-ubuntu-setup.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run bootc-ubuntu-setup
         uses: ./common/.github/actions/bootc-ubuntu-setup
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run bootc-ubuntu-setup with libvirt
         uses: ./common/.github/actions/bootc-ubuntu-setup
diff --git a/common/.github/workflows/openssf-scorecard.yml b/common/.github/workflows/openssf-scorecard.yml
index 2166beb..314a0fa 100644
--- a/common/.github/workflows/openssf-scorecard.yml
+++ b/common/.github/workflows/openssf-scorecard.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
@@ -37,7 +37,7 @@ jobs:
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: SARIF file
           path: results.sarif
diff --git a/common/.github/workflows/rebase.yml b/common/.github/workflows/rebase.yml
index ab42fbc..68f329a 100644
--- a/common/.github/workflows/rebase.yml
+++ b/common/.github/workflows/rebase.yml
@@ -21,13 +21,13 @@ jobs:
           owner: ${{ github.repository_owner }}
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
 
       - name: Automatic Rebase
-        uses: peter-evans/rebase@v3
+        uses: peter-evans/rebase@v4
         with:
           token: ${{ steps.token.outputs.token }}