diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec1dfff..ee50171 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
       has-vitest:     ${{ steps.check.outputs.has-vitest }}
       has-playwright: ${{ steps.check.outputs.has-playwright }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check for project files
         id: check
         run: |
@@ -89,7 +89,7 @@ jobs:
       needs.detect.outputs.has-vite == 'true' &&
       (github.event.pull_request.draft == false || github.event_name != 'pull_request')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -106,7 +106,7 @@ jobs:
       needs.detect.outputs.has-vite == 'true' &&
       (github.event.pull_request.draft == false || github.event_name != 'pull_request')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -138,7 +138,7 @@ jobs:
       needs.typecheck.result == 'success' &&
       needs.lint.result == 'success'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -156,7 +156,7 @@ jobs:
             echo "   pnpm add -D vitest @vitest/coverage-v8"
           fi
       - name: Upload coverage
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         if: needs.detect.outputs.has-vitest == 'true'
         with:
           files: ./coverage/lcov.info
@@ -168,7 +168,7 @@ jobs:
     needs: test
     if: needs.test.result == 'success'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -191,7 +191,7 @@ jobs:
       needs.build.result == 'success' &&
       needs.detect.outputs.has-playwright == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
@@ -219,9 +219,9 @@ jobs:
       needs.detect.outputs.has-vite == 'true' &&
       needs.build.result == 'success'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Trivy Dockerfile scan
-        uses: aquasecurity/trivy-action@0.35.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: config
           scan-ref:  docker/Dockerfile.prod
@@ -234,7 +234,7 @@ jobs:
     needs: detect
     if: needs.detect.outputs.has-lockfile == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 45c3443..d382e03 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -34,7 +34,7 @@ jobs:
       image-tags:   ${{ steps.meta.outputs.tags }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Check if project is initialised
         id: project-check
         run: |
diff --git a/.github/workflows/dockerhub-description.yml b/.github/workflows/dockerhub-description.yml
index 607f2d1..246e038 100644
--- a/.github/workflows/dockerhub-description.yml
+++ b/.github/workflows/dockerhub-description.yml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           sparse-checkout: README.md
 
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 9800484..9c62d9b 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           sparse-checkout: .github/labels.yml
       - name: Sync labels