diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af2bd2f1..fc08c069 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -487,7 +487,7 @@ jobs:
           key: feature-clippy-ffmpeg-webrtc
       - name: Log in to GHCR
         # The base image package is read via the workflow token (packages: read).
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -668,7 +668,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: install @asyncapi/cli
@@ -892,7 +892,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -932,7 +932,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -971,7 +971,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.code == 'true' }}
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 1e80307e..8c3184a0 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -86,7 +86,7 @@ jobs:
       # Login + push only when NOT a pull_request (forks must not publish).
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -154,7 +154,7 @@ jobs:
         uses: docker/setup-buildx-action@v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -219,7 +219,7 @@ jobs:
           if [ "$sbom" = "null" ] || [ -z "$sbom" ]; then echo "::error::merged manifest lost SBOM"; exit 1; fi
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v4.1.1
+        uses: actions/attest-build-provenance@v4.2.2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.manifest.outputs.digest }}
diff --git a/.github/workflows/ffmpeg-base.yml b/.github/workflows/ffmpeg-base.yml
index 00245373..b976d700 100644
--- a/.github/workflows/ffmpeg-base.yml
+++ b/.github/workflows/ffmpeg-base.yml
@@ -94,7 +94,7 @@ jobs:
 
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -164,7 +164,7 @@ jobs:
         uses: docker/setup-buildx-action@v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -202,7 +202,7 @@ jobs:
           if [ "$sbom" = "null" ] || [ -z "$sbom" ]; then echo "::error::merged manifest lost SBOM"; exit 1; fi
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v4.1.1
+        uses: actions/attest-build-provenance@v4.2.2
         with:
           subject-name: ${{ env.IMAGE }}
           subject-digest: ${{ steps.manifest.outputs.digest }}
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index e2545b2c..f0480beb 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -41,7 +41,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable # matches ci.yml + rust-toolchain.toml (channel = stable)
 
       - name: Run release-plz
-        uses: release-plz/action@v0.5.130 # v0.5.129
+        uses: release-plz/action@v0.5.131 # v0.5.129
         with:
           command: release-pr
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad160e74..7f05d3ac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -200,12 +200,12 @@ jobs:
           echo "checksum=dist/${STAGE}.tar.gz.sha256" >> "$GITHUB_OUTPUT"
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v4.1.1 # v4 (4.1.0)
+        uses: actions/attest-build-provenance@v4.2.2 # v4 (4.1.0)
         with:
           subject-path: ${{ steps.package.outputs.archive }}
 
       - name: Attach to GitHub Release
-        uses: softprops/action-gh-release@v3.0.1 # v2 (2.4.1)
+        uses: softprops/action-gh-release@v3.0.2 # v2 (2.4.1)
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |