diff --git a/.github/actions/package-toolchain/action.yml b/.github/actions/package-toolchain/action.yml
index c95719634..7aefa905c 100644
--- a/.github/actions/package-toolchain/action.yml
+++ b/.github/actions/package-toolchain/action.yml
@@ -40,7 +40,7 @@ runs:
         echo "toolchain-cache key: $KEY"
 
     - name: Cache musl sysroot + libc++
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       id: cache
       with:
         path: |
diff --git a/.github/workflows/force-rebuild.yml b/.github/workflows/force-rebuild.yml
index a23097ac5..72929c8ae 100644
--- a/.github/workflows/force-rebuild.yml
+++ b/.github/workflows/force-rebuild.yml
@@ -200,7 +200,7 @@ jobs:
         run: bash scripts/dev-shell.sh true
 
       - name: Cache xtask build
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -387,7 +387,7 @@ jobs:
           echo "toolchain-cache key: $KEY"
 
       - name: Cache musl sysroot + libc++
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         id: cache
         with:
           path: |
diff --git a/.github/workflows/prepare-merge.yml b/.github/workflows/prepare-merge.yml
index 4a1b44cc4..868aadba7 100644
--- a/.github/workflows/prepare-merge.yml
+++ b/.github/workflows/prepare-merge.yml
@@ -632,7 +632,7 @@ jobs:
         run: bash scripts/dev-shell.sh true
 
       - name: Cache xtask build
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/reusable-homebrew-bottle-maintenance.yml b/.github/workflows/reusable-homebrew-bottle-maintenance.yml
index bc34d756f..eccbd18a2 100644
--- a/.github/workflows/reusable-homebrew-bottle-maintenance.yml
+++ b/.github/workflows/reusable-homebrew-bottle-maintenance.yml
@@ -103,7 +103,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout tap
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: main
@@ -111,7 +111,7 @@ jobs:
           fetch-depth: 0
 
       - name: Checkout Kandelo workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: Automattic/kandelo
diff --git a/.github/workflows/reusable-homebrew-bottle-publish.yml b/.github/workflows/reusable-homebrew-bottle-publish.yml
index 3ea24d5d3..6ff0b29ea 100644
--- a/.github/workflows/reusable-homebrew-bottle-publish.yml
+++ b/.github/workflows/reusable-homebrew-bottle-publish.yml
@@ -147,7 +147,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Checkout Kandelo workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -156,7 +156,7 @@ jobs:
           submodules: false
 
       - name: Checkout tap
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -364,7 +364,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout Kandelo workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -373,7 +373,7 @@ jobs:
           submodules: false
 
       - name: Checkout tap
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -401,7 +401,7 @@ jobs:
           }
 
       - name: Checkout reviewed Homebrew implementation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: Homebrew/brew
@@ -807,7 +807,7 @@ jobs:
           fi
 
       - name: Checkout exact post-build Kandelo validator source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -816,7 +816,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact post-build tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -997,7 +997,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout exact Kandelo validator source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -1190,7 +1190,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.formula-matrix) }}
     steps:
       - name: Checkout exact Kandelo index publisher source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -1383,7 +1383,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout exact Kandelo verifier source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -1392,7 +1392,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact Kandelo sysroot build source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -1401,7 +1401,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -1428,7 +1428,7 @@ jobs:
           }
 
       - name: Checkout reviewed Homebrew implementation for bottle verification
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: Homebrew/brew
@@ -2103,7 +2103,7 @@ jobs:
           fi
 
       - name: Checkout exact post-verification Kandelo generator source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -2112,7 +2112,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact post-verification tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -2677,7 +2677,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout exact Kandelo finalizer source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -2686,7 +2686,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact base tap without credentials
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -2768,7 +2768,7 @@ jobs:
 
       - name: Checkout tap publication branch after payload validation
         if: ${{ steps.validate-payload.outcome == 'success' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ inputs.tap-repository }}
           ref: main
@@ -2812,7 +2812,7 @@ jobs:
 
       - name: Checkout clean tap for a failed-attempt report
         if: ${{ always() && (steps.publish-handoff.outcome != 'success' || steps.validate-payload.outcome != 'success' || steps.publish.outcome != 'success') }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ inputs.tap-repository }}
           ref: main
diff --git a/.github/workflows/reusable-homebrew-repository-namespace-canary.yml b/.github/workflows/reusable-homebrew-repository-namespace-canary.yml
index 1eca490aa..82a012022 100644
--- a/.github/workflows/reusable-homebrew-repository-namespace-canary.yml
+++ b/.github/workflows/reusable-homebrew-repository-namespace-canary.yml
@@ -47,7 +47,7 @@ jobs:
           }
 
       - name: Checkout exact Kandelo canary source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           repository: Automattic/kandelo
diff --git a/.github/workflows/reusable-package-source-publish.yml b/.github/workflows/reusable-package-source-publish.yml
index e507ecf56..604fbf177 100644
--- a/.github/workflows/reusable-package-source-publish.yml
+++ b/.github/workflows/reusable-package-source-publish.yml
@@ -68,7 +68,7 @@ jobs:
           git -C kandelo submodule update --init --depth 1 musl
 
       - name: Cache Cargo and Kandelo sysroots
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/staging-build.yml b/.github/workflows/staging-build.yml
index 4b48fbc7a..50742a437 100644
--- a/.github/workflows/staging-build.yml
+++ b/.github/workflows/staging-build.yml
@@ -152,7 +152,7 @@ jobs:
         run: bash scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.sh
 
       - name: Cache xtask build
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           path: |
             ~/.cargo/registry