diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87cd185d..a99a7acc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Run tests
         working-directory: ./determine-stacks
@@ -37,10 +37,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Run tests
         working-directory: ./evaluate-automerge
@@ -53,7 +53,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run tests
         working-directory: ./terraform-deploy
@@ -66,10 +66,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Run tests
         working-directory: ./build-gp-config
@@ -114,7 +114,7 @@ jobs:
       statuses: write
     services:
       moto:
-        image: motoserver/moto:5.1.22@sha256:117238c6e7e3b566387c4c74e6fb0b6fdc34a094920c2154cf06f11dc72d9f37
+        image: motoserver/moto:5.2.2@sha256:0349ef6ecb9cd041293026accda0ea71bfa09925dffae3d76d120d15ecc76971
         ports:
           - 5000:5000
     env:
@@ -151,7 +151,7 @@ jobs:
         }
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare S3 buckets and dummy files
         run: |
@@ -232,7 +232,7 @@ jobs:
       statuses: write
     services:
       moto:
-        image: motoserver/moto:5.1.22@sha256:117238c6e7e3b566387c4c74e6fb0b6fdc34a094920c2154cf06f11dc72d9f37
+        image: motoserver/moto:5.2.2@sha256:0349ef6ecb9cd041293026accda0ea71bfa09925dffae3d76d120d15ecc76971
         ports:
           - 5000:5000
     env:
@@ -259,7 +259,7 @@ jobs:
         }
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare Docker mock
         run: |
@@ -304,7 +304,7 @@ jobs:
       contents: read
     services:
       moto:
-        image: motoserver/moto:5.1.22@sha256:117238c6e7e3b566387c4c74e6fb0b6fdc34a094920c2154cf06f11dc72d9f37
+        image: motoserver/moto:5.2.2@sha256:0349ef6ecb9cd041293026accda0ea71bfa09925dffae3d76d120d15ecc76971
         ports:
           - 5000:5000
     env:
@@ -314,7 +314,7 @@ jobs:
       AWS_ENDPOINT_URL: http://localhost:5000
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare ephemeral SSH deploy key
         id: ssh-key
@@ -414,7 +414,7 @@ jobs:
       contents: read
     services:
       moto:
-        image: motoserver/moto:5.1.22@sha256:117238c6e7e3b566387c4c74e6fb0b6fdc34a094920c2154cf06f11dc72d9f37
+        image: motoserver/moto:5.2.2@sha256:0349ef6ecb9cd041293026accda0ea71bfa09925dffae3d76d120d15ecc76971
         ports:
           - 5000:5000
     env:
@@ -424,7 +424,7 @@ jobs:
       AWS_ENDPOINT_URL: http://localhost:5000
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare ephemeral SSH deploy key
         id: ssh-key
diff --git a/.github/workflows/label_new_issues-remove_label.yml b/.github/workflows/label_new_issues-remove_label.yml
index 81aec88b..3a23b4cf 100644
--- a/.github/workflows/label_new_issues-remove_label.yml
+++ b/.github/workflows/label_new_issues-remove_label.yml
@@ -32,7 +32,7 @@ jobs:
     steps:
 
       - name: Checkout ⚙️
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/label_new_issues.yml b/.github/workflows/label_new_issues.yml
index 170d9749..ac4c62d5 100644
--- a/.github/workflows/label_new_issues.yml
+++ b/.github/workflows/label_new_issues.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
 
 
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             github.rest.issues.addLabels({
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5e4acaa..a4ee9b19 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,18 +40,18 @@ jobs:
     steps:
 
       - name: Run Release Please
-        uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: r
 
 
       - if: ${{ steps.r.outputs.releases_created }}
         name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
 
       - if: ${{ steps.r.outputs.releases_created }}
         name: Import okctl-bot GPG key
-        uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY_FOR_MACHINE_USER }}
           passphrase: ${{ secrets.GPG_PASSPHRASE_FOR_MACHINE_USER }}
diff --git a/.github/workflows/update-input-docs.yml b/.github/workflows/update-input-docs.yml
index a89c88bd..78d5aa16 100644
--- a/.github/workflows/update-input-docs.yml
+++ b/.github/workflows/update-input-docs.yml
@@ -21,11 +21,11 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           cache-dependency-glob: |
             boilerplate/replace_between.py
@@ -40,7 +40,7 @@ jobs:
       - if: inputs.create_pr || github.event_name == 'schedule'
         name: Import okctl-bot GPG key
         id: gpg
-        uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY_FOR_MACHINE_USER }}
           passphrase: ${{ secrets.GPG_PASSPHRASE_FOR_MACHINE_USER }}
@@ -54,7 +54,7 @@ jobs:
       - if: inputs.create_pr || github.event_name == 'schedule'
         name: Create pull request (if changes)
         id: pr
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           author: "${{ steps.gpg.outputs.name }} <${{ steps.gpg.outputs.email }}>"
           committer: "${{ steps.gpg.outputs.name }} <${{ steps.gpg.outputs.email }}>"
diff --git a/build-gp-config/action.yml b/build-gp-config/action.yml
index 4ceee32a..7faf4ec1 100644
--- a/build-gp-config/action.yml
+++ b/build-gp-config/action.yml
@@ -22,7 +22,7 @@ runs:
   using: composite
   steps:
     - name: Install uv
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       with:
         # No dependencies to cache — script uses only stdlib
         enable-cache: false
diff --git a/cloudfront-deploy/action.yml b/cloudfront-deploy/action.yml
index aa4eadff..5562679a 100644
--- a/cloudfront-deploy/action.yml
+++ b/cloudfront-deploy/action.yml
@@ -22,7 +22,7 @@ runs:
   using: 'composite'
   steps:
     - name: Configure AWS credentials using the OpenID Connect (OIDC) provider 🔑
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ inputs.aws-region }}
         role-to-assume: ${{ inputs.aws-role-arn }}
diff --git a/determine-stacks/action.yml b/determine-stacks/action.yml
index af195a37..a5572692 100644
--- a/determine-stacks/action.yml
+++ b/determine-stacks/action.yml
@@ -50,7 +50,7 @@ runs:
   using: "composite"
   steps:
     - name: Detect changed stack files
-      uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
       id: filter
       if: ${{ inputs.selected-stacks == '' }}
       with:
@@ -60,7 +60,7 @@ runs:
             - '**/*'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
     - name: Determine stacks
       id: stacks
diff --git a/disallow-same-approver/action.yml b/disallow-same-approver/action.yml
index 5867cce6..88123424 100644
--- a/disallow-same-approver/action.yml
+++ b/disallow-same-approver/action.yml
@@ -8,7 +8,7 @@ runs:
   steps:
 
     - name: Do not allow the person who initiated the deployment to approve it
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
 
diff --git a/ecs-update-and-deploy-task-definition/action.yml b/ecs-update-and-deploy-task-definition/action.yml
index 699b9515..325b0034 100644
--- a/ecs-update-and-deploy-task-definition/action.yml
+++ b/ecs-update-and-deploy-task-definition/action.yml
@@ -53,7 +53,7 @@ runs:
 
   steps:
     - name: Configure AWS credentials using the OpenID Connect (OIDC) provider 🔑
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: "${{ inputs.aws-region }}"
         role-to-assume: "${{ inputs.aws-role-arn }}"
@@ -62,7 +62,7 @@ runs:
 
     - name: Login to Elastic Container Registry (ECR) 🔑
       id: ecr-login
-      uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
+      uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
 
 
     - name: Download existing ECS task definition ⚙️
@@ -76,7 +76,7 @@ runs:
 
     - name: Update ECS task definition with new image URIs ⚙️
       id: update-task-definition
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         INPUT_IMAGES: ${{ inputs.images }}
       with:
@@ -139,7 +139,7 @@ runs:
     - if: inputs.deploy == 'true'
       name: Deploy task definition 🚀
       id: deploy
-      uses: aws-actions/amazon-ecs-deploy-task-definition@4b08990e8909cf36bc2ca95f994312f090c41865 # v2.3.4
+      uses: aws-actions/amazon-ecs-deploy-task-definition@c465972ecbd160473f22e683363b422a5412a3de # v2.6.3
       with:
         cluster: "${{ inputs.cluster-name }}"
         service: "${{ inputs.service-name }}"
diff --git a/evaluate-automerge/action.yml b/evaluate-automerge/action.yml
index 89b82402..aa5dc879 100644
--- a/evaluate-automerge/action.yml
+++ b/evaluate-automerge/action.yml
@@ -18,7 +18,7 @@ runs:
   using: "composite"
   steps:
     - name: Install uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       with:
         working-directory: ${{ github.action_path }}
 
diff --git a/package-and-upload-artifact/action.yml b/package-and-upload-artifact/action.yml
index 4dc20e25..f2865a04 100644
--- a/package-and-upload-artifact/action.yml
+++ b/package-and-upload-artifact/action.yml
@@ -25,7 +25,7 @@ runs:
     - name: Configure AWS credentials in dev
       if: ${{ fromJSON(inputs.config).dev != null }}
       id: aws-credentials-dev
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ fromJSON(inputs.config).dev.defaultRegion }}
         role-to-assume: ${{ fromJSON(inputs.config).dev.artifactRoleArn }}
@@ -35,7 +35,7 @@ runs:
     - name: Configure AWS credentials in prod
       if: ${{ fromJSON(inputs.config).prod != null }}
       id: aws-credentials-prod
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ fromJSON(inputs.config).prod.defaultRegion }}
         role-to-assume: ${{ fromJSON(inputs.config).prod.artifactRoleArn }}
diff --git a/renovate-metadata/action.yml b/renovate-metadata/action.yml
index 5555c4a0..c7e5cda3 100644
--- a/renovate-metadata/action.yml
+++ b/renovate-metadata/action.yml
@@ -30,7 +30,7 @@ runs:
   steps:
 
     - name: Checkout
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: ${{ inputs.fetch-depth }}
 
@@ -42,7 +42,7 @@ runs:
 
     - name: Check commits, verify signatures, and parse Renovate metadata
       id: check-commits-and-parse-metadata
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const jsYaml = require('js-yaml');
diff --git a/setup-ok/action.yml b/setup-ok/action.yml
index 436d2a9c..f5723b3f 100644
--- a/setup-ok/action.yml
+++ b/setup-ok/action.yml
@@ -142,7 +142,7 @@ runs:
 
 
     - name: Restore cache
-      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       id: cache-tools-restore
       env:
         BIN_DIR: ${{ steps.bin-dir.outputs.dir }}
@@ -270,7 +270,7 @@ runs:
     # See: https://github.com/actions/cache/blob/main/save/README.md#always-save-cache
     - name: Save cache
       if: always() && steps.cache-tools-restore.outputs.cache-hit != 'true' && steps.install-tools.outcome == 'success'
-      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       env:
         BIN_DIR: ${{ steps.bin-dir.outputs.dir }}
         VERSIONS: ${{ steps.versions.outputs.versions }}
diff --git a/terraform-deploy/action.yml b/terraform-deploy/action.yml
index b74bff3d..2bee997d 100644
--- a/terraform-deploy/action.yml
+++ b/terraform-deploy/action.yml
@@ -111,7 +111,7 @@ runs:
 
     - name: Get GitHub App token
       if: inputs.target-repository != github.event.repository.name
-      uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       id: get-token
       with:
         app-id: ${{ inputs.github-app-id }}
@@ -122,7 +122,7 @@ runs:
 
     - name: Checkout
       if: inputs.target-repository != github.event.repository.name
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       id: checkout
       with:
         repository: "${{ github.repository_owner }}/${{ inputs.target-repository }}"
@@ -131,7 +131,7 @@ runs:
         fetch-depth: 1
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
       with:
         aws-region: ${{ fromJSON(inputs.config)[inputs.environment].defaultRegion }}
         role-to-assume: ${{ fromJSON(inputs.config)[inputs.environment].deploymentRoleArn }}
@@ -152,7 +152,7 @@ runs:
         echo "TERRAFORM_VERSION=$(grep required_version *.tf | sed -E 's/[^"]+"([^"]+)"+/\1/')" >> "$GITHUB_OUTPUT"
 
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
+      uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
       with:
         terraform_version: ${{ steps.v.outputs.TERRAFORM_VERSION }}