diff --git a/.github/workflows/codex.yml b/.github/workflows/codex.yml
index 90e4bb9..4363728 100644
--- a/.github/workflows/codex.yml
+++ b/.github/workflows/codex.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
       - name: Setup project
-        uses: generoi/github-actions/setup@v1
+        uses: generoi/github-actions/setup@v2
         with:
           npm_fontawesome_auth_token: ${{ secrets.NPM_FONTAWESOME_AUTH_TOKEN }}
           packagist_github_token: ${{ secrets.PACKAGIST_GITHUB_TOKEN }}
@@ -33,10 +33,10 @@ jobs:
         run: composer install:development
 
       - name: Setup DDEV
-        uses: generoi/github-actions/setup-ddev@v1
+        uses: generoi/github-actions/setup-ddev@v2
 
       - name: Download database artifact
-        uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
         with:
           workflow: sync-db.yml
           name: sanitized-db
@@ -91,7 +91,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: codex-artifacts
           path: artifacts/
diff --git a/.github/workflows/composer-update-tests.yml b/.github/workflows/composer-update-tests.yml
index 7724786..af7cde0 100644
--- a/.github/workflows/composer-update-tests.yml
+++ b/.github/workflows/composer-update-tests.yml
@@ -19,7 +19,7 @@ jobs:
     name: Run composer-update tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The PHP helper tests run the real helpers and bootstrap composer/semver
       # into a temp vendor dir. jq, git and bash are preinstalled on the runner.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3a31051..60c650f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -39,15 +39,15 @@ jobs:
     environment: ${{ inputs.environment }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start SSH agent
-        uses: generoi/github-actions/ssh-agent@v1
+        uses: generoi/github-actions/ssh-agent@v2
         with:
           ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
 
       - name: Setup project
-        uses: generoi/github-actions/setup@v1
+        uses: generoi/github-actions/setup@v2
         with:
           npm_fontawesome_auth_token: ${{ secrets.NPM_FONTAWESOME_AUTH_TOKEN }}
           packagist_github_token: ${{ secrets.PACKAGIST_GITHUB_TOKEN }}
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index bfafac2..6a098e7 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -18,10 +18,10 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .nvmrc
           cache: 'npm'
@@ -60,7 +60,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: e2e-test-results
           path: test-results/
diff --git a/.github/workflows/sync-db.yml b/.github/workflows/sync-db.yml
index da257a5..ab7e638 100644
--- a/.github/workflows/sync-db.yml
+++ b/.github/workflows/sync-db.yml
@@ -21,14 +21,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
-      - uses: generoi/github-actions/ssh-agent@v1
+      - uses: generoi/github-actions/ssh-agent@v2
         with:
           ssh-private-key: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
 
       - name: Setup project
-        uses: generoi/github-actions/setup@v1
+        uses: generoi/github-actions/setup@v2
         with:
           npm_fontawesome_auth_token: ${{ secrets.NPM_FONTAWESOME_AUTH_TOKEN }}
           packagist_github_token: ${{ secrets.PACKAGIST_GITHUB_TOKEN }}
@@ -46,7 +46,7 @@ jobs:
             $(yq '.env["@production"].host' robo.yml) >> ~/.ssh/known_hosts
 
       - name: Setup DDEV
-        uses: generoi/github-actions/setup-ddev@v1
+        uses: generoi/github-actions/setup-ddev@v2
 
       - name: Pull database from production
         run: ./vendor/bin/robo db:pull @production
@@ -67,7 +67,7 @@ jobs:
             -pass env:DB_ARTIFACT_KEY
 
       - name: Upload sanitized DB artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: sanitized-db
           path: .github/fixtures/sanitized-db.sql.gz.enc
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c3e81fa..60eccfa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -43,10 +43,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup project
-        uses: generoi/github-actions/setup@v1
+        uses: generoi/github-actions/setup@v2
         with:
           npm_fontawesome_auth_token: ${{ secrets.NPM_FONTAWESOME_AUTH_TOKEN }}
           packagist_github_token: ${{ secrets.PACKAGIST_GITHUB_TOKEN }}
@@ -62,7 +62,7 @@ jobs:
         run: composer ci --no-interaction
 
       - name: Install WordPress
-        uses: generoi/github-actions/install-wordpress@v1
+        uses: generoi/github-actions/install-wordpress@v2
         with:
           multisite: ${{ inputs.multisite }}
           activate_plugins: ${{ inputs.activate_plugins }}
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index bd57f5a..426af5f 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -103,7 +103,7 @@ jobs:
       # night. Spread the scans with distinct cron minutes in the calling repos
       # instead — scheduling costs nothing. See README for the current offsets.
       - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Deliberately not generoi/github-actions/setup: this job audits the lock
       # file and never touches vendor/ or node_modules. The shared action would
@@ -287,7 +287,7 @@ jobs:
 
       - name: Composer download cache
         if: failure() && inputs.auto_update && steps.scan.outputs.packages != ''
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-php${{ env.PHP_VERSION }}-${{ hashFiles('**/composer.lock') }}