diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 868a2042f..4c2d46b85 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -27,11 +27,11 @@ jobs:
     name: go-test-e2e
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       with:
         node-version: '20'
     - run: cd web && npm install
@@ -42,11 +42,11 @@ jobs:
     name: go-test-e2e-contrib
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v6
       with:
         node-version: '20'
     - run: cd web && npm install
@@ -57,8 +57,8 @@ jobs:
     name: go-test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
     - run: make test
@@ -67,8 +67,8 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
     - run: make lint
@@ -77,8 +77,8 @@ jobs:
     name: verify
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
     - run: make verify
@@ -87,9 +87,9 @@ jobs:
     name: image-build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
-    - uses: docker/setup-buildx-action@v3
+    - uses: docker/setup-buildx-action@v4
     - run: make image-local
diff --git a/.github/workflows/docs-gen-and-push.yaml b/.github/workflows/docs-gen-and-push.yaml
index 89bcd68fd..abcc3e432 100644
--- a/.github/workflows/docs-gen-and-push.yaml
+++ b/.github/workflows/docs-gen-and-push.yaml
@@ -29,17 +29,17 @@ jobs:
     name: Docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
       - run: git fetch origin gh-pages
       - run: git fetch origin '+refs/tags/v*:refs/tags/v*' --no-tags
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: v1.26.2
           cache: true
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
           cache: 'pip'
diff --git a/.github/workflows/goreleaser.yaml b/.github/workflows/goreleaser.yaml
index fee2f1e4b..776f3215d 100644
--- a/.github/workflows/goreleaser.yaml
+++ b/.github/workflows/goreleaser.yaml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
     - name: Delete non-semver tags
@@ -29,7 +29,7 @@ jobs:
       run: echo LDFLAGS="$(make ldflags)" >> $GITHUB_ENV
     - name: Run GoReleaser on tag
       if: github.event_name != 'pull_request'
-      uses: goreleaser/goreleaser-action@v3
+      uses: goreleaser/goreleaser-action@v7
       with:
         distribution: goreleaser
         version: latest
@@ -39,7 +39,7 @@ jobs:
         KREW_GITHUB_TOKEN: ${{ secrets.KREW_GITHUB_TOKEN }}
     - name: Run GoReleaser on pull request
       if: github.event_name == 'pull_request'
-      uses: goreleaser/goreleaser-action@v3
+      uses: goreleaser/goreleaser-action@v7
       with:
         distribution: goreleaser
         version: latest
@@ -47,7 +47,7 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         KREW_GITHUB_TOKEN: ${{ secrets.KREW_GITHUB_TOKEN }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@v7
       if: ${{ always() }}
       with:
         name: binaries
diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
index f7d4ed2c1..366f44f75 100644
--- a/.github/workflows/image.yaml
+++ b/.github/workflows/image.yaml
@@ -16,8 +16,8 @@ jobs:
   image:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
         go-version: v1.26.2
         check-latest: true
@@ -27,13 +27,13 @@ jobs:
       run: 'git tag -d $(git tag -l | grep -v "^v")'
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
 
     # If you notice signing errors, you may need to update the cosign version.
-    - uses: sigstore/cosign-installer@v3.7.0
+    - uses: sigstore/cosign-installer@v4.1.2
 
     - name: Install Helm
-      uses: azure/setup-helm@v3
+      uses: azure/setup-helm@v5
       with:
         version: 'v3.12.0'
 
@@ -64,7 +64,7 @@ jobs:
         fi
 
     - name: Login to GitHub Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -81,7 +81,7 @@ jobs:
     - name: Build and push Helm charts
       run: make release-helm
 
-    - uses: actions/delete-package-versions@v3
+    - uses: actions/delete-package-versions@v5
       with:
         package-name: '${{ github.event.repository.name }}'
         min-versions-to-keep: 10