diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml
index 7d48399da..7a79ac671 100644
--- a/.github/workflows/benchmark.yaml
+++ b/.github/workflows/benchmark.yaml
@@ -84,7 +84,7 @@ jobs:
 
       - name: "Notify in Slack if benchmark job failed"
         if: "${{ failure() }}"
-        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
+        uses: "slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d" # v4.0.0
         with:
           webhook: "${{ secrets.SLACK_BUILDS_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 1bd5ea5b8..36881f3f1 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -58,7 +58,7 @@ jobs:
     steps:
       - uses: "actions/checkout@v7"
       - uses: "authzed/actions/setup-go@main"
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         with:
           username: "${{ env.DOCKERHUB_PUBLIC_USER }}"
           password: "${{ env.DOCKERHUB_PUBLIC_ACCESS_TOKEN }}"
@@ -108,7 +108,7 @@ jobs:
     steps:
       - uses: "actions/checkout@v7"
       - uses: "authzed/actions/setup-go@main"
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         with:
           username: "${{ env.DOCKERHUB_PUBLIC_USER }}"
           password: "${{ env.DOCKERHUB_PUBLIC_ACCESS_TOKEN }}"
@@ -136,7 +136,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         if: |
           needs.paths-filter.outputs.codechange == 'true'
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         if: |
           needs.paths-filter.outputs.codechange == 'true'
         with:
@@ -170,7 +170,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         if: |
           needs.paths-filter.outputs.codechange == 'true'
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         if: |
           needs.paths-filter.outputs.codechange == 'true'
         with:
@@ -205,7 +205,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         if: |
           needs.paths-filter.outputs.codechange == 'true'
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         if: |
           needs.paths-filter.outputs.codechange == 'true'
         with:
@@ -240,7 +240,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         if: |
           needs.paths-filter.outputs.codechange == 'true'
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         if: |
           needs.paths-filter.outputs.codechange == 'true'
         with:
@@ -279,7 +279,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         if: |
           needs.paths-filter.outputs.codechange == 'true'
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         if: |
           needs.paths-filter.outputs.codechange == 'true'
         with:
@@ -318,7 +318,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         if: |
           needs.paths-filter.outputs.codechange == 'true'
-      - uses: "docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4" # v4.3.0
+      - uses: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" # v4.6.0
         if: |
           needs.paths-filter.outputs.codechange == 'true'
         with:
@@ -416,7 +416,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
       - name: "Generate Protos"
         run: "go run mage.go gen:proto"
-      - uses: "chainguard-dev/actions/nodiff@f0be69916b439d0fcced2451b23d0f27cd46d545" # main
+      - uses: "chainguard-dev/actions/nodiff@b2555de0cf9724fb9b49d050ff18bd1f49562ba7" # main
         with:
           path: ""
           fixup-command: "go run mage.go gen:proto"
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 030223120..fc2e17768 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -75,7 +75,7 @@ jobs:
 
       - name: "Notify in Slack if failure"
         if: "${{ failure() }}"
-        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
+        uses: "slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d" # v4.0.0
         with:
           webhook: "${{ secrets.SLACK_BUILDS_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
diff --git a/.github/workflows/keep-a-changelog.yaml b/.github/workflows/keep-a-changelog.yaml
index cb834d800..946cdc333 100644
--- a/.github/workflows/keep-a-changelog.yaml
+++ b/.github/workflows/keep-a-changelog.yaml
@@ -28,7 +28,7 @@ jobs:
           skipLabels: "Skip-Changelog,dependencies,tests"
           missingUpdateErrorMessage: "If your PR has a change that users might care about, please add an entry to CHANGELOG.md, run 'npx keep-a-changelog', and commit the changes. Otherwise, add the Skip-Changelog label to your PR."
       - uses: "actions/checkout@v7"
-      - uses: "actions/setup-node@v6"
+      - uses: "actions/setup-node@v7"
       - run: "npx keep-a-changelog@2.8.0"
       - run: |
           files=$(git status --porcelain)
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 9a10b2a54..438326365 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -17,7 +17,7 @@ jobs:
     permissions:
       pull-requests: "write"
     steps:
-      - uses: "actions/labeler@f27b608878404679385c85cfa523b85ccb86e213" # v6.1.0
+      - uses: "actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13" # v7.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           sync-labels: true
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index b89fd73ae..b0bae4e2d 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -35,7 +35,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
       - name: "Generate docs"
         run: "go run mage.go gen:docs"
-      - uses: "chainguard-dev/actions/nodiff@f0be69916b439d0fcced2451b23d0f27cd46d545" # main
+      - uses: "chainguard-dev/actions/nodiff@b2555de0cf9724fb9b49d050ff18bd1f49562ba7" # main
         with:
           path: ""
           fixup-command: "mage gen:docs"
@@ -47,7 +47,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
       - name: "Lint Everything"
         run: "go run mage.go lint:all"
-      - uses: "chainguard-dev/actions/nodiff@f0be69916b439d0fcced2451b23d0f27cd46d545" # main
+      - uses: "chainguard-dev/actions/nodiff@b2555de0cf9724fb9b49d050ff18bd1f49562ba7" # main
         with:
           path: ""
           fixup-command: "go run mage.go lint:all"
diff --git a/.github/workflows/release-windows.yaml b/.github/workflows/release-windows.yaml
index ff1de54f8..68f9aff16 100644
--- a/.github/workflows/release-windows.yaml
+++ b/.github/workflows/release-windows.yaml
@@ -18,7 +18,7 @@ jobs:
         with:
           fetch-depth: 0
       - uses: "authzed/actions/setup-go@main"
-      - uses: "nowsprinting/check-version-format-action@485fbf1df432e42859933ebaf16f27f7cdb7bde7" # v5.0.2
+      - uses: "nowsprinting/check-version-format-action@ee32a64fe737aeac52fe802f1bf8c3454f93a86c" # v5.0.3
         id: "version"
         with:
           prefix: "v"
@@ -40,7 +40,7 @@ jobs:
           CHOCOLATEY_API_KEY: "${{ secrets.CHOCOLATEY_API_KEY }}"
       - name: "Notify Slack if failure"
         if: "failure()"
-        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
+        uses: "slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d" # v4.0.0
         with:
           webhook: "${{ secrets.SLACK_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8a58a8728..496925462 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,7 +19,7 @@ jobs:
         with:
           fetch-depth: 0
       - uses: "authzed/actions/setup-go@main"
-      - uses: "nowsprinting/check-version-format-action@485fbf1df432e42859933ebaf16f27f7cdb7bde7" # v5.0.2
+      - uses: "nowsprinting/check-version-format-action@ee32a64fe737aeac52fe802f1bf8c3454f93a86c" # v5.0.3
         id: "version"
         with:
           prefix: "v"
@@ -54,7 +54,7 @@ jobs:
           SNAPCRAFT_STORE_CREDENTIALS: "${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}"
       - name: "Notify Slack of goreleaser status"
         if: "always()"
-        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
+        uses: "slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d" # v4.0.0
         with:
           webhook: "${{ secrets.SLACK_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index cfdcf9b25..e7f19c265 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -51,7 +51,7 @@ jobs:
           # trivy does not flag an old SpiceDB version
           fetch-depth: 0
       - uses: "authzed/actions/setup-go@main"
-      - uses: "docker/login-action@v4.3.0" # v3.7.0
+      - uses: "docker/login-action@v4.6.0" # v3.7.0
         with:
           username: "${{ env.DOCKERHUB_PUBLIC_USER }}"
           password: "${{ env.DOCKERHUB_PUBLIC_ACCESS_TOKEN }}"