diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 1c9dbd606..265430014 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -34,7 +34,7 @@ jobs:
         - retest
         - torun
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Use Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
       with:
diff --git a/.github/workflows/autotools.yml b/.github/workflows/autotools.yml
index 81c3ff01e..901d65930 100644
--- a/.github/workflows/autotools.yml
+++ b/.github/workflows/autotools.yml
@@ -36,7 +36,7 @@ jobs:
         - arch: aarch64
           runs-on: ubuntu-22.04-arm
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Fetch versions
       id: deps
       run: |
@@ -146,7 +146,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@v4
       with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index dc0be13cf..10a8f8b4b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b  # v3.29.2
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 71f298999..86aba43e4 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,7 +15,7 @@ jobs:
   lint:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: "3.13"
diff --git a/.github/workflows/py.yml b/.github/workflows/py.yml
index ff6fea75c..783007671 100644
--- a/.github/workflows/py.yml
+++ b/.github/workflows/py.yml
@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'envoyproxy'
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: "3.11"
@@ -91,7 +91,7 @@ jobs:
   lint:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: "3.11"
@@ -106,7 +106,7 @@ jobs:
   typecheck:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: "3.11"
@@ -122,7 +122,7 @@ jobs:
     # TODO: reenable once plugin is fixed
     if: false
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: "3.11"
@@ -142,7 +142,7 @@ jobs:
     - typecheck
     # - docs
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
       with:
         python-version: "3.11"
@@ -164,7 +164,7 @@ jobs:
     needs:
     - package
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index ee4c36e70..7cfc4a8f4 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'envoyproxy'
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions-rust-lang/setup-rust-toolchain@v1
       with:
         toolchain: nightly
@@ -43,7 +43,7 @@ jobs:
         rust:
         - stable
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - uses: actions-rust-lang/setup-rust-toolchain@v1
       with:
         toolchain: ${{ matrix.rust }}
@@ -65,7 +65,7 @@ jobs:
           runs-on: ubuntu-24.04-arm
           rust-target: aarch64-unknown-linux-gnu
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
 
     - name: Install Rust toolchain
       uses: actions-rust-lang/setup-rust-toolchain@v1
@@ -105,7 +105,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
       with:
diff --git a/.github/workflows/sanitizer-libs.yml b/.github/workflows/sanitizer-libs.yml
index c36b4133f..80a84eadf 100644
--- a/.github/workflows/sanitizer-libs.yml
+++ b/.github/workflows/sanitizer-libs.yml
@@ -32,7 +32,7 @@ jobs:
       matrix:
         sanitizer: [msan, tsan]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Setup Bazel
       uses: bazelbuild/setup-bazelisk@v3
     - name: Install libtinfo
@@ -58,7 +58,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
       with:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 40676cd78..b13ed0f47 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/sh.yml b/.github/workflows/sh.yml
index 6f9085aa0..2a8c535d1 100644
--- a/.github/workflows/sh.yml
+++ b/.github/workflows/sh.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - run: |
         sudo apt-get update
         sudo apt-get  -qq install -y inotify-tools
diff --git a/.github/workflows/sysroot.yml b/.github/workflows/sysroot.yml
index e16b4797a..f3b77dc32 100644
--- a/.github/workflows/sysroot.yml
+++ b/.github/workflows/sysroot.yml
@@ -37,7 +37,7 @@ jobs:
           runs-on: ubuntu-24.04-arm
           variant: libstdcxx
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Set versions
       id: versions
       run: |
@@ -130,7 +130,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
       with:
diff --git a/.github/workflows/update-versions.yml b/.github/workflows/update-versions.yml
index fcce87705..02deda1ac 100644
--- a/.github/workflows/update-versions.yml
+++ b/.github/workflows/update-versions.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Determine release tag
       id: release
       env: