diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ad8720..879257e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,17 +16,17 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
       - run: uv sync --locked
       - run: make check
 
   secrets:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 5a119ee..2d2ba3a 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -11,18 +11,18 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Tag
         id: tag
         # main-<unix-ts>-<sha>: sortable by time, traceable to a commit. A GitOps
         # image policy picks the newest by the timestamp (see gitops-reference).
         run: echo "tag=main-$(date +%s)-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v7
         with:
           context: .
           push: true
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index 7c8bfe1..b407ea1 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -11,7 +11,7 @@ jobs:
   links:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # linkedin.com answers bots with HTTP 999; it is excluded, not ignored silently.
       - uses: lycheeverse/lychee-action@v2
         with: