diff --git a/.github/workflows/code.yml b/.github/workflows/code.yml
index 1f5752a..219b72d 100644
--- a/.github/workflows/code.yml
+++ b/.github/workflows/code.yml
@@ -22,7 +22,7 @@ jobs:
       DATABASE_URL: mysql://root:rootpassword@localhost/ispyb_build
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
 
       - name: Install dependencies
         uses: awalsh128/cache-apt-pkgs-action@v1.4.2
@@ -79,7 +79,7 @@ jobs:
       DATABASE_URL: mysql://root:rootpassword@localhost/ispyb_build
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
 
       - name: Install dependencies
         uses: awalsh128/cache-apt-pkgs-action@v1.4.2
diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index ef63bc9..20c6ed4 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -23,14 +23,14 @@ jobs:
       packages: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
 
       - name: Generate Image Name
         run: echo IMAGE_REPOSITORY=ghcr.io/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]' | tr '[_]' '[\-]') >> $GITHUB_ENV
 
       - name: Log in to GitHub Docker Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3.1.0
+        uses: docker/login-action@v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -46,7 +46,7 @@ jobs:
             type=raw,value=latest
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.3.0
+        uses: docker/setup-buildx-action@v3.6.1
         with:
           driver-opts: network=host
 
diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
index 7e09de7..bf9c289 100644
--- a/.github/workflows/devcontainer.yml
+++ b/.github/workflows/devcontainer.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.3.0
+        uses: docker/setup-buildx-action@v3.6.1
 
       - name: Create .env file
         run: touch .devcontainer/opa.env
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 3a08c73..62c7872 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
         with:
           fetch-depth: 0
 
@@ -39,7 +39,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
 
       - name: Retrieve chart dependencies
         working-directory: charts/datasets
@@ -54,7 +54,7 @@ jobs:
 
       - name: Log in to GitHub Docker Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3.1.0
+        uses: docker/login-action@v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/schema.yml b/.github/workflows/schema.yml
index 5c117c5..ade4192 100644
--- a/.github/workflows/schema.yml
+++ b/.github/workflows/schema.yml
@@ -22,7 +22,7 @@ jobs:
       DATABASE_URL: mysql://root:rootpassword@localhost:3306/ispyb_build
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4.1.4
+        uses: actions/checkout@v4.1.7
 
       - name: Install stable toolchain
         uses: actions-rs/toolchain@v1.0.7
@@ -42,7 +42,7 @@ jobs:
             --path datasets.graphql
 
       - name: Upload Schema Artifact
-        uses: actions/upload-artifact@v4.3.3
+        uses: actions/upload-artifact@v4.3.4
         with:
           name: datasets.graphql
           path: datasets.graphql
@@ -60,7 +60,7 @@ jobs:
             echo "$HOME/.rover/bin" >> $GITHUB_PATH
 
         - name: Download Schema Artifact
-          uses: actions/download-artifact@v4.1.7
+          uses: actions/download-artifact@v4.1.8
           with:
             name: datasets.graphql