diff --git a/.github/workflows/bootloader.yml b/.github/workflows/bootloader.yml
index 6b6284d1..d07dd95f 100644
--- a/.github/workflows/bootloader.yml
+++ b/.github/workflows/bootloader.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           cache-dependency-path: "**/go.sum"
@@ -36,7 +36,7 @@ jobs:
       - name: Build bootloader
         run: ARCH=${{ matrix.arch }} ./bootloader/build.sh
       - name: Upload artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: kernel-${{ matrix.arch }}
           path: target/bootloader-${{ matrix.arch }}/kernel-${{ matrix.arch }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a9609d23..b4b9d9d4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Build
         run: RUSTFLAGS='-C target-feature=+crt-static' cargo +stable build --target ${{ matrix.target }} --release
       - name: Upload artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: alioth-${{ matrix.target }}
           path: target/${{ matrix.target }}/release/alioth
@@ -46,7 +46,7 @@ jobs:
               >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
       - name: Download all artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           path: artifacts
       - name: Create tarballs
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index ce2d970f..8864cf9b 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -50,7 +50,7 @@ jobs:
         with:
           components: clippy
       - name: Install tools
-        uses: taiki-e/install-action@650c5ca14212efbbf3e580844b04bdccf68dac31 # v2.67.18
+        uses: taiki-e/install-action@68675c5a5f1a6950c3975d33f3ae0ef155e5bf3d # v2.68.15
         with:
           tool: cargo-llvm-cov,cargo-deny
       - name: Check dependencies
@@ -71,7 +71,7 @@ jobs:
       - name: Clippy
         run: cargo clippy -- -D warnings
       - name: Upload coverage report artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: lcov-${{ matrix.target.name }}.info
           path: lcov-${{ matrix.target.name }}.info
@@ -82,7 +82,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Download coverage reports
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           path: lcov
           pattern: lcov-*.info