diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b3d9d268..3340a1eb2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -84,7 +84,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && hashFiles('package-lock.json') != '' && 'npm' || '' }}
diff --git a/.github/workflows/cross-browser-matrix.yml b/.github/workflows/cross-browser-matrix.yml
index 654682114..33559deef 100644
--- a/.github/workflows/cross-browser-matrix.yml
+++ b/.github/workflows/cross-browser-matrix.yml
@@ -23,9 +23,9 @@ jobs:
     runs-on: [self-hosted, linux, x64, vps-verify]
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
@@ -45,7 +45,7 @@ jobs:
 
       - name: Upload artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cross-browser-failures
           path: test-results/
diff --git a/.github/workflows/d1-backup-r2.yml b/.github/workflows/d1-backup-r2.yml
index 3c85551dd..766d43395 100644
--- a/.github/workflows/d1-backup-r2.yml
+++ b/.github/workflows/d1-backup-r2.yml
@@ -72,7 +72,7 @@ jobs:
           printf 'D1_BACKUP_LOCAL_DIRECTORY=%s\n' \
             "$RUNNER_TEMP/0509-d1-backups-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
             >> "$GITHUB_ENV"
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
diff --git a/.github/workflows/d1-backup-validate.yml b/.github/workflows/d1-backup-validate.yml
index 33cef7d32..edbe9ba49 100644
--- a/.github/workflows/d1-backup-validate.yml
+++ b/.github/workflows/d1-backup-validate.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, vps-verify]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
diff --git a/.github/workflows/d1-remote-restore-evidence.yml b/.github/workflows/d1-remote-restore-evidence.yml
index 9a403e148..7dabf4186 100644
--- a/.github/workflows/d1-remote-restore-evidence.yml
+++ b/.github/workflows/d1-remote-restore-evidence.yml
@@ -97,7 +97,7 @@ jobs:
           printf 'D1_BACKUP_LOCAL_DIRECTORY=%s\n' \
             "$RUNNER_TEMP/0509-d1-backups-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
             >> "$GITHUB_ENV"
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
@@ -190,7 +190,7 @@ jobs:
           printf 'D1_BACKUP_LOCAL_DIRECTORY=%s\n' \
             "$RUNNER_TEMP/0509-d1-backups-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
             >> "$GITHUB_ENV"
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
@@ -289,7 +289,7 @@ jobs:
           printf 'D1_BACKUP_LOCAL_DIRECTORY=%s\n' \
             "$RUNNER_TEMP/0509-d1-backups-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
             >> "$GITHUB_ENV"
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index 8f6cb09aa..457f07952 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -90,7 +90,7 @@ jobs:
       sha: ${{ steps.pin.outputs.sha }}
       backup_proof_status: ${{ needs.authorize_release.outputs.backup_proof_status }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.authorize_release.outputs.sha }}
           fetch-depth: 0
@@ -119,7 +119,7 @@ jobs:
       PINNED_SHA: ${{ needs.pin_candidate.outputs.sha }}
       BACKUP_PROOF_STATUS: ${{ needs.pin_candidate.outputs.backup_proof_status }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.pin_candidate.outputs.sha }}
           fetch-depth: 0
@@ -131,7 +131,7 @@ jobs:
           EXPECTED_SHA: ${{ inputs.expected_sha || '' }}
           GH_TOKEN: ${{ github.token }}
         run: ./scripts/deploy-window-lock.sh run -- ./scripts/ci-verify-production-candidate.sh
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
@@ -200,7 +200,7 @@ jobs:
       PINNED_SHA: ${{ needs.pin_candidate.outputs.sha }}
       BACKUP_PROOF_STATUS: ${{ needs.pin_candidate.outputs.backup_proof_status }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.pin_candidate.outputs.sha }}
           fetch-depth: 0
@@ -245,7 +245,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
diff --git a/.github/workflows/finalize-production-soak.yml b/.github/workflows/finalize-production-soak.yml
index de799ba52..d7c2b8bfa 100644
--- a/.github/workflows/finalize-production-soak.yml
+++ b/.github/workflows/finalize-production-soak.yml
@@ -35,7 +35,7 @@ jobs:
       name: production
       url: https://0509.io
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
 
       - name: Verify successful protected production deploy
         id: verify_deploy_run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           DEPLOY_RUN_ID: ${{ inputs.deploy_run_id }}
           DEPLOY_RUN_ATTEMPT: ${{ inputs.deploy_run_attempt }}
@@ -105,11 +105,11 @@ jobs:
             core.setOutput("run-id", String(run.id));
             core.setOutput("run-attempt", String(run.run_attempt));
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.verify_deploy_run.outputs.sha }}
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: ".node-version"
           cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 496bee534..79b214721 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -71,7 +71,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.authorize_release.outputs.sha }}
           fetch-depth: 0
diff --git a/tests/deploy-production-gate.test.ts b/tests/deploy-production-gate.test.ts
index 8b90e2eb0..20af7236c 100644
--- a/tests/deploy-production-gate.test.ts
+++ b/tests/deploy-production-gate.test.ts
@@ -1248,7 +1248,7 @@ writeFileSync(process.env.FAKE_WRANGLER_INVOCATION, JSON.stringify(process.argv.
       "utf8",
     );
     const checkoutIndex = workflow.indexOf(
-      "- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10",
+      "- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
     );
     const acquireIndex = workflow.indexOf("- name: Acquire deploy window");
     const verifySecretsIndex = workflow.indexOf(
diff --git a/tests/finalize-production-soak-workflow.test.ts b/tests/finalize-production-soak-workflow.test.ts
index 0324a3a8f..98561b1d2 100644
--- a/tests/finalize-production-soak-workflow.test.ts
+++ b/tests/finalize-production-soak-workflow.test.ts
@@ -31,7 +31,7 @@ describe("production soak finalization workflow", () => {
     const provenance = parsed.jobs?.finalize?.steps?.find((step) => step.name === "Verify successful protected production deploy");
     expect(provenance?.id).toBe("verify_deploy_run");
     expect(provenance?.uses).toBe(
-      "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd",
+      "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3",
     );
     const script = String(provenance?.with?.script);
     expect(script).toContain("github.rest.actions.getWorkflowRun");