diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8f42b9..e2e893d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Run tests with race detector
         shell: bash
         run: go test -race -coverprofile=coverage.txt ./...
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: matrix.os == 'ubuntu-latest'
         with:
           name: coverage
@@ -71,7 +71,7 @@ jobs:
             -X main.gitCommit=${GITHUB_SHA} \
             -X main.buildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
             -o dist/laststate-relay ./cmd/laststate-relay
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: relay-binary
           path: dist/laststate-relay
@@ -119,7 +119,7 @@ jobs:
       - name: Generate CycloneDX SBOM
         shell: bash
         run: syft dir:. --quiet --output cyclonedx-json=sbom.cdx.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sbom
           path: |
@@ -141,7 +141,7 @@ jobs:
           pattern: relay-binary
           path: dist/
           merge-multiple: true
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: relay-binary
           path: dist/laststate-relay
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index acccb21..d3783e7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,8 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@v3
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/autobuild@v4
+      - uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7bf64fa..e399c10 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,7 @@ jobs:
               -X main.gitCommit=$(git rev-parse --short HEAD) \
               -X main.buildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
               -o dist/laststate-relay-${{ matrix.target.suffix }} ./cmd/laststate-relay
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: relay-${{ matrix.target.suffix }}
           path: dist/laststate-relay-${{ matrix.target.suffix }}
@@ -80,7 +80,7 @@ jobs:
               -X main.gitCommit=$(git rev-parse --short HEAD) \
               -X main.buildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
               -o dist/laststate-relay-windows-amd64.exe ./cmd/laststate-relay
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: relay-windows-amd64
           path: dist/laststate-relay-windows-amd64.exe
@@ -112,7 +112,7 @@ jobs:
               -X main.gitCommit=$(git rev-parse --short HEAD) \
               -X main.buildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
               -o dist/laststate-relay-${{ matrix.target.suffix }} ./cmd/laststate-relay
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: relay-${{ matrix.target.suffix }}
           path: dist/laststate-relay-${{ matrix.target.suffix }}
@@ -132,7 +132,7 @@ jobs:
         shell: bash
         run: |
           VERSION="${GITHUB_REF_NAME#v}" ARCH=amd64 bash packaging/deb/build.sh
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: relay-deb
           path: dist/*.deb
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 923eddc..5492881 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -36,7 +36,7 @@ jobs:
         run: |
           test -s sbom.spdx.json || { echo "sbom.spdx.json is missing or empty" >&2; exit 1; }
           test -s sbom.cdx.json  || { echo "sbom.cdx.json  is missing or empty" >&2; exit 1; }
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sbom
           path: |