diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 3fca96f2cc..6c8d563501 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Get token from Github App
         id: app_token
-        uses: actions/create-github-app-token@v2.2.1
+        uses: actions/create-github-app-token@v3.0.0
         with:
           app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }}
diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
index 505d5c3d74..313f7fd5ac 100644
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Chromatic
         if: env.CHROMATIC_PROJECT_TOKEN
-        uses: chromaui/action@v15.1.0
+        uses: chromaui/action@v15.3.0
         with:
           projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
           onlyChanged: true # 👈 Required option to enable TurboSnap
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 89bed00ae1..b1ab023229 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -211,7 +211,7 @@ jobs:
           key: dist-${{ github.sha }}
           fail-on-cache-miss: true
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.12.0
+        uses: docker/setup-buildx-action@v4.0.0
       - name: Configure AWS credentials
         if: vars.ECR_REGION
         uses: aws-actions/configure-aws-credentials@v6.0.0
@@ -222,7 +222,7 @@ jobs:
       - name: Login to Amazon ECR
         id: login-ecr
         if: vars.ECR_REGION
-        uses: aws-actions/amazon-ecr-login@v2.0.1
+        uses: aws-actions/amazon-ecr-login@v2.0.2
       - name: Format image tag parts
         env:
           BRANCH: ${{ github.head_ref || github.ref_name }}
@@ -234,7 +234,7 @@ jobs:
           echo SHORT_SHA=${SHA::8} >> "$GITHUB_ENV"
       - name: Build image
         if: vars.ECR_REGION
-        uses: docker/build-push-action@v6.19.2
+        uses: docker/build-push-action@v7.0.0
         with:
           context: .
           file: ./${{ matrix.target.file }}
@@ -252,7 +252,7 @@ jobs:
           cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=${{ env.REPOSITORY_URI }}:${{ env.SANITIZED_BRANCH }}-${{ matrix.platform }}-cache
       - name: Build image
         if: ${{ !vars.ECR_REGION }}
-        uses: docker/build-push-action@v6.19.2
+        uses: docker/build-push-action@v7.0.0
         with:
           context: .
           file: ./${{ matrix.target.file }}
@@ -278,7 +278,7 @@ jobs:
           aws-region: ${{ vars.ECR_REGION }}
       - name: Login to Amazon ECR
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2.0.1
+        uses: aws-actions/amazon-ecr-login@v2.0.2
       - name: Format image tag components
         env:
           BRANCH: ${{ github.head_ref || github.ref_name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 74aa71d7e1..2965e6a3ab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
       VERSION: ${{ needs.get-version.outputs.version }}
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.12.0
+        uses: docker/setup-buildx-action@v4.0.0
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6.0.0
         with:
@@ -53,9 +53,9 @@ jobs:
           aws-region: ${{ vars.ECR_REGION }}
       - name: Login to private ECR
         id: login-private-ecr
-        uses: aws-actions/amazon-ecr-login@v2.0.1
+        uses: aws-actions/amazon-ecr-login@v2.0.2
       - name: Login to public ECR
-        uses: aws-actions/amazon-ecr-login@v2.0.1
+        uses: aws-actions/amazon-ecr-login@v2.0.2
         env:
           AWS_REGION: ${{ vars.ECR_PUBLIC_REGION }}
         with:
@@ -94,7 +94,7 @@ jobs:
       - name: Create a GitHub release
         id: create-github-release
         if: inputs.github_release
-        uses: softprops/action-gh-release@v2.5.0
+        uses: softprops/action-gh-release@v2.6.1
         with:
           target_commitish: ${{ github.sha }}
           tag_name: ${{ env.VERSION }}
@@ -133,7 +133,7 @@ jobs:
     steps:
       - name: Get GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v2.2.1
+        uses: actions/create-github-app-token@v3.0.0
         with:
           app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }}
@@ -154,7 +154,7 @@ jobs:
     steps:
       - name: Get token from Github App
         id: app_token
-        uses: actions/create-github-app-token@v2.2.1
+        uses: actions/create-github-app-token@v3.0.0
         with:
           app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }}
@@ -175,7 +175,7 @@ jobs:
     steps:
       - name: Get GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v2.2.1
+        uses: actions/create-github-app-token@v3.0.0
         with:
           app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }}
diff --git a/.github/workflows/sync-internal.yml b/.github/workflows/sync-internal.yml
index a75811d88d..db42bd5e16 100644
--- a/.github/workflows/sync-internal.yml
+++ b/.github/workflows/sync-internal.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Get token from Github App
         id: app_token
-        uses: actions/create-github-app-token@v2.2.1
+        uses: actions/create-github-app-token@v3.0.0
         with:
           app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }}