diff --git a/.github/workflows/ci-container-build.yaml b/.github/workflows/ci-container-build.yaml
index 834e7a4b50..aacd0d60e4 100644
--- a/.github/workflows/ci-container-build.yaml
+++ b/.github/workflows/ci-container-build.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Login to Docker Hub
         if: github.event.pull_request == null || github.event.pull_request.head.repo.fork == false
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/ci-frontend-lint.yaml b/.github/workflows/ci-frontend-lint.yaml
index 11495ded24..e30537b5e5 100644
--- a/.github/workflows/ci-frontend-lint.yaml
+++ b/.github/workflows/ci-frontend-lint.yaml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Biome
         uses: biomejs/setup-biome@v2
@@ -54,7 +54,7 @@ jobs:
           fi
 
       - name: Render lint report to PR
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
         if: always() && hashFiles('frontend/biome-report.md') != '' && github.event.pull_request.head.repo.fork == false
         with:
           header: frontend-lint-results
diff --git a/.github/workflows/ci-test.yaml b/.github/workflows/ci-test.yaml
index 9fefb6610e..c3a227ecfd 100644
--- a/.github/workflows/ci-test.yaml
+++ b/.github/workflows/ci-test.yaml
@@ -23,17 +23,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
         with:
           # Install a specific version of uv.
           version: "0.6.14"
           python-version: 3.12.9
 
       - name: Cache tox environments
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: .tox/
           key: ${{ runner.os }}-tox-uv-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }}
@@ -41,7 +41,7 @@ jobs:
             ${{ runner.os }}-tox-uv-
 
       - name: Install tox with UV
-        run: uv pip install tox tox-uv
+        run: uv tool install tox --with tox-uv
 
       - name: Run tox
         id: tox
@@ -54,7 +54,7 @@ jobs:
           bash .github/scripts/combine-test-reports.sh
 
       - name: Render combined test report to PR
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
         if: always() && hashFiles('combined-test-report.md') != '' && github.event.pull_request.head.repo.fork == false
         with:
           header: test-results
diff --git a/.github/workflows/docker-tools-build-push.yaml b/.github/workflows/docker-tools-build-push.yaml
index 0174dc8962..439f4fbe81 100644
--- a/.github/workflows/docker-tools-build-push.yaml
+++ b/.github/workflows/docker-tools-build-push.yaml
@@ -33,23 +33,23 @@ jobs:
         run: echo "${{ toJSON(github.event.inputs) }}"
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Set up QEMU for ARM64 emulation
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: linux/amd64,linux/arm64/v8
 
       # Set up Docker Buildx for better caching and multi-arch builds
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           platforms: linux/amd64,linux/arm64/v8
 
       # Log in to Docker Hub
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -90,7 +90,7 @@ jobs:
 
       # Build and push Docker image
       - name: Build and push ${{ github.event.inputs.service_name }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ${{ steps.build-config.outputs.context }}
           file: ${{ steps.build-config.outputs.dockerfile }}
diff --git a/.github/workflows/production-build.yaml b/.github/workflows/production-build.yaml
index 3f5abaa25a..bcf4faa3e3 100644
--- a/.github/workflows/production-build.yaml
+++ b/.github/workflows/production-build.yaml
@@ -37,29 +37,29 @@ jobs:
     steps:
       - name: Checkout code for release
         if: github.event_name == 'release'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Checkout code for branch
         if: github.event_name != 'release'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Set up QEMU for ARM64 emulation
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: linux/amd64,linux/arm64/v8
 
       # Set up Docker Buildx for better caching and multi-arch builds
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           platforms: linux/amd64,linux/arm64/v8
 
       # Log in to Docker Hub
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -91,7 +91,7 @@ jobs:
 
       # Build and push using Docker Bake
       - name: Build and push image
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v7
         env:
           VERSION: ${{ env.DOCKER_VERSION_TAG }}
         with:
@@ -123,7 +123,7 @@ jobs:
       # Upload status for summary job
       - name: Upload build status
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: build-status-${{ matrix.service_name }}
           path: build-status/${{ matrix.service_name }}.json
@@ -137,7 +137,7 @@ jobs:
     steps:
       # Download all build status artifacts
       - name: Download build statuses
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: build-status-*
           merge-multiple: true
diff --git a/.github/workflows/uv-lock-automation.yaml b/.github/workflows/uv-lock-automation.yaml
index 202ff234d5..453c098bb9 100644
--- a/.github/workflows/uv-lock-automation.yaml
+++ b/.github/workflows/uv-lock-automation.yaml
@@ -25,12 +25,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
         with:
           # Install a specific version of uv.
           version: "0.6.14"