diff --git a/.github/workflows/postsubmit.yaml b/.github/workflows/postsubmit.yaml
index 0eab3f430..89e02e7de 100644
--- a/.github/workflows/postsubmit.yaml
+++ b/.github/workflows/postsubmit.yaml
@@ -16,7 +16,7 @@ jobs:
       with:
         tool-cache: true
     - name: Checkout repository
-      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
     - name: Install bazel
       run: sudo bash toolchain/bazel/install_bazel.sh
     - name: Install toolchain dependencies
@@ -24,7 +24,7 @@ jobs:
     - name: Load cache config
       run: cat .config/cache-config.env >> $GITHUB_ENV
     - name: Mount bazel cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: "~/bazel-disk-cache"
         key: ${{ format('{0}-{1}-bazel-disk-cache-{2}-{3}-{4}-{5}', runner.os, runner.arch, env.CACHE_VERSION, github.ref_name, github.sha, github.event_name) }}
@@ -47,7 +47,7 @@ jobs:
       with:
         tool-cache: true
     - name: Checkout repository
-      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
     - name: Install bazel
       run: sudo bash toolchain/bazel/install_bazel.sh
     - name: Install toolchain dependencies
@@ -55,7 +55,7 @@ jobs:
     - name: Load cache config
       run: cat .config/cache-config.env >> $GITHUB_ENV
     - name: Mount bazel cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: "~/bazel-disk-cache"
         key: ${{ format('{0}-{1}-bazel-disk-cache-{2}-debian-package-{3}-{4}-{5}', runner.os, runner.arch, env.CACHE_VERSION, github.ref_name, github.sha, github.event_name) }}
diff --git a/.github/workflows/presubmit.yaml b/.github/workflows/presubmit.yaml
index 59284ff60..320214d5e 100644
--- a/.github/workflows/presubmit.yaml
+++ b/.github/workflows/presubmit.yaml
@@ -41,7 +41,7 @@ jobs:
       with:
         tool-cache: true
     - name: Checkout repository
-      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
     - name: Install toolchain dependencies
       run: sudo bash toolchain/cmake/install_toolchain_dependencies.sh
     - name: Configure Build
@@ -62,7 +62,7 @@ jobs:
       with:
         tool-cache: true
     - name: Checkout repository
-      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
     - name: Install toolchain dependencies
       run: sudo bash toolchain/meson/install_toolchain_dependencies.sh
     - name: Configure Build
@@ -82,7 +82,7 @@ jobs:
         shell: msys2 {0}
     steps:
       - name: Checkout current PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: msys2/setup-msys2@v2
diff --git a/.github/workflows/presubmit_bazel.yml b/.github/workflows/presubmit_bazel.yml
index c13d394af..be8f304e5 100644
--- a/.github/workflows/presubmit_bazel.yml
+++ b/.github/workflows/presubmit_bazel.yml
@@ -28,7 +28,7 @@ jobs:
         tool-cache: true
 
     - name: Checkout repository
-      uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 # aka v2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
     - name: Install bazel
       run: sudo bash toolchain/bazel/install_bazel.sh
@@ -43,7 +43,7 @@ jobs:
       run: cat .config/cache-config.env >> $GITHUB_ENV
 
     - name: Mount Bazel cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: "~/bazel-disk-cache"
         key: ${{ format('{0}-{1}-bazel-disk-cache-{2}-{3}-{4}-', runner.os, runner.arch, env.CACHE_VERSION, github.ref_name, github.sha) }}