diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index bb301793ca1..d352b2c7b40 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -60,7 +60,7 @@ jobs:
           sanitizer: ${{ matrix.sanitizer }}
           output-sarif: true
       - name: Upload Crash
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         if: failure() && steps.build.outcome == 'success'
         with:
           name: ${{ matrix.sanitizer }}-${{ matrix.architecture }}-artifacts
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7ebb7491506..c2b9493f6d8 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -130,7 +130,7 @@ jobs:
             --quiet
 
       - name: Archive failed test journals
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
         with:
           name: ci-coverage-${{ github.run_id }}-${{ github.run_attempt }}-arch-rolling-failed-test-journals
diff --git a/.github/workflows/development-freeze.yml b/.github/workflows/development-freeze.yml
index be75a2c421c..25f6c1e92cf 100644
--- a/.github/workflows/development-freeze.yml
+++ b/.github/workflows/development-freeze.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - id: artifact
         name: Download Pull Request Metadata artifact
-        uses: redhat-plumbers-in-action/download-artifact@103e5f882470b59e9d71c80ecb2d0a0b91a7c43b
+        uses: redhat-plumbers-in-action/download-artifact@03d5b806a9dca9928eb5628833fe81a0558f23bb
         with:
           name: Pull Request Metadata
 
diff --git a/.github/workflows/gather-pr-metadata.yml b/.github/workflows/gather-pr-metadata.yml
index f9cfd9154e6..2ae9a098a69 100644
--- a/.github/workflows/gather-pr-metadata.yml
+++ b/.github/workflows/gather-pr-metadata.yml
@@ -25,7 +25,7 @@ jobs:
         uses: redhat-plumbers-in-action/gather-pull-request-metadata@b86d1eaf7038cf88a56b26ba3e504f10e07b0ce5
 
       - name: Upload Pull Request Metadata artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: Pull Request Metadata
           path: ${{ steps.metadata.outputs.metadata-file }}
diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index 72daed60ef2..3aa169f55ad 100644
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe
         with:
           prerelease: ${{ contains(github.ref_name, '-rc') }}
           draft: ${{ github.repository == 'systemd/systemd' }}
diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index c83be9c78df..5fd1469ba35 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -324,7 +324,7 @@ jobs:
             "${MAX_LINES[@]}"
 
       - name: Archive failed test journals
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: failure() && (github.repository == 'systemd/systemd' || github.repository == 'systemd/systemd-stable')
         with:
           name: ci-mkosi-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.distro }}-${{ matrix.release }}-${{ matrix.runner }}-failed-test-journals