diff --git a/.github/workflows/concommits.yaml b/.github/workflows/concommits.yaml
index c5742c236..f9e5d8dd3 100644
--- a/.github/workflows/concommits.yaml
+++ b/.github/workflows/concommits.yaml
@@ -1,3 +1,4 @@
+---
 name: tools
 
 on:
diff --git a/.github/workflows/dispatch.yaml b/.github/workflows/dispatch.yaml
index b093e152d..cbd9aca16 100644
--- a/.github/workflows/dispatch.yaml
+++ b/.github/workflows/dispatch.yaml
@@ -1,3 +1,4 @@
+---
 name: dispatch
 
 defaults:
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index a52113da3..a26208deb 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -1,3 +1,4 @@
+---
 name: github
 on:
   - pull_request_target
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b7588c6dd..ef3d07713 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,3 +1,4 @@
+---
 name: release
 
 defaults:
@@ -75,11 +76,11 @@ jobs:
           make test
       - name: upload validator(s) stdout/stderr
         if: always() && steps.test.outcome != 'skipped'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: logs
           path: |
-            .cache/run/upgrade/validators/logs/*.log 
+            .cache/run/upgrade/validators/logs/*.log
 
   notify-homebrew:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 4697ac9be..443204145 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -1,20 +1,20 @@
+---
 name: github
 on:
   schedule:
-  - cron: "0 0 * * *"
+    - cron: "0 0 * * *"
 
 jobs:
   stale-pr:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v3
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-pr-label: stale
-        exempt-pr-labels: keepalive
-        days-before-stale: 10
-        days-before-close: 5
-        stale-pr-message: |
-          Marked as stale; will be closed in five days.
-
-          Cut bait or go fishing!
+      - uses: actions/stale@v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          stale-pr-label: stale
+          exempt-pr-labels: keepalive
+          days-before-stale: 10
+          days-before-close: 5
+          stale-pr-message: |
+            Marked as stale; will be closed in five days.
+            Cut bait or go fishing!
diff --git a/.github/workflows/standardize-yaml.yaml b/.github/workflows/standardize-yaml.yaml
index 0e707b090..49d7edea4 100644
--- a/.github/workflows/standardize-yaml.yaml
+++ b/.github/workflows/standardize-yaml.yaml
@@ -1,3 +1,4 @@
+---
 name: tools
 on:
   push:
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 34220e417..0fffe23c0 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -1,3 +1,4 @@
+---
 name: tests
 
 defaults:
@@ -87,7 +88,7 @@ jobs:
       - name: set environment
         uses: HatsuneMiku3939/direnv-action@v1
       - run: make test-coverage
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
 
   lint:
     runs-on: ubuntu-latest
@@ -109,7 +110,7 @@ jobs:
       - name: lint all
         run: make test-lint-all
       - name: lint make-sublinters
-        run: make test-sublinters 
+        run: make test-sublinters
 
   shellcheck:
     runs-on: ubuntu-latest
@@ -170,7 +171,7 @@ jobs:
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      - uses: fregante/setup-git-user@v1
+      - uses: fregante/setup-git-user@v2
       - name: configure git tag
         run: echo "RELEASE_TAG=v$(./script/semver.sh bump patch $(git describe --tags $(git rev-list --tags --max-count=1)))" >> $GITHUB_ENV
       - name: git tag
@@ -231,7 +232,7 @@ jobs:
           make test
       - name: upload validator(s) stdout/stderr
         if: always() && steps.test.outcome != 'skipped'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: validators-logs
           path: |