diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index f8368c0..5ae1b5b 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -26,7 +26,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup BATS
         uses: bats-core/bats-action@4.0.0
       - name: Install bash and GNU parallel (macOS only)
@@ -49,14 +49,14 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install pre-commit
         run: |
           pip install --upgrade pip
           pip install --upgrade pre-commit
       - name: Cache pre-commit hooks
         id: cache-pre-commit-hooks
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           CACHE_NUMBER: 1
         with:
diff --git a/.github/workflows/bot-automerge.yml b/.github/workflows/bot-automerge.yml
index 724e4fc..9e71751 100644
--- a/.github/workflows/bot-automerge.yml
+++ b/.github/workflows/bot-automerge.yml
@@ -27,7 +27,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Dependabot metadata
         if: github.actor == 'dependabot[bot]'
         id: dependabot
diff --git a/.github/workflows/changelog-autoupdate.yml b/.github/workflows/changelog-autoupdate.yml
index 36cea09..d33dbf8 100644
--- a/.github/workflows/changelog-autoupdate.yml
+++ b/.github/workflows/changelog-autoupdate.yml
@@ -17,17 +17,17 @@ jobs:
   changelog-autoupdate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Full history needed for git cliff
       - name: Install git-cliff
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@v2.85.4
         with:
           tool: git-cliff
       - name: Update Unreleased section
         run: scripts/update-unreleased.sh
       - name: Format CHANGELOG.md
-        uses: DavidAnson/markdownlint-cli2-action@v23
+        uses: DavidAnson/markdownlint-cli2-action@v24
         with:
           config: .markdownlint.yml
           globs: |
diff --git a/.github/workflows/delete-bot-branches-for-closed-prs.yml b/.github/workflows/delete-bot-branches-for-closed-prs.yml
index d39a610..9254980 100644
--- a/.github/workflows/delete-bot-branches-for-closed-prs.yml
+++ b/.github/workflows/delete-bot-branches-for-closed-prs.yml
@@ -20,7 +20,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.merged == false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: detect bot author
         id: bot-author-check
         uses: ./.github/actions/detect-bot-author
diff --git a/.github/workflows/lint-github-actions.yml b/.github/workflows/lint-github-actions.yml
index a028f25..7936a31 100644
--- a/.github/workflows/lint-github-actions.yml
+++ b/.github/workflows/lint-github-actions.yml
@@ -26,7 +26,7 @@ jobs:
               - added|modified:
                 - .github/workflows/*.yaml
                 - .github/workflows/*.yml
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: >-
           github.event_name == 'push' ||
           github.event_name == 'workflow_dispatch' ||
diff --git a/.github/workflows/pre-commit-autoupdate.yml b/.github/workflows/pre-commit-autoupdate.yml
index 7e2cde2..bce3802 100644
--- a/.github/workflows/pre-commit-autoupdate.yml
+++ b/.github/workflows/pre-commit-autoupdate.yml
@@ -20,10 +20,10 @@ jobs:
       BRANCH_NAME: chore/pre-commit-autoupdate
       PRECOMMIT_CONFIG_FILE: .pre-commit-config.yaml
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           check-latest: true
           cache: pip
@@ -33,7 +33,7 @@ jobs:
           python -m pip install pre-commit
       - name: Cache pre-commit hooks
         id: cache-pre-commit
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           CACHE_NUMBER: 0
         with:
diff --git a/.github/workflows/test-prepare-readme.yml b/.github/workflows/test-prepare-readme.yml
index c72c5dd..2edc3e2 100644
--- a/.github/workflows/test-prepare-readme.yml
+++ b/.github/workflows/test-prepare-readme.yml
@@ -30,7 +30,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install bash (macOS only)
         if: matrix.os == 'macos-latest'
         run: |
diff --git a/.github/workflows/validate-scripts.yml b/.github/workflows/validate-scripts.yml
index 5dd30ef..6451961 100644
--- a/.github/workflows/validate-scripts.yml
+++ b/.github/workflows/validate-scripts.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0 # Full history for diff checks