diff --git a/.github/workflows/action-test.yml b/.github/workflows/action-test.yml
index 0a97b4c..01ee5e8 100644
--- a/.github/workflows/action-test.yml
+++ b/.github/workflows/action-test.yml
@@ -11,7 +11,7 @@ jobs:
   use-local-action:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: gitagger version
@@ -38,7 +38,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Build sandbox repo
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 16f0aaa..bca0795 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,8 +36,8 @@ jobs:
             goarch: arm64
             suffix: ""
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: build
@@ -47,7 +47,7 @@ jobs:
           CGO_ENABLED: 0
         run: go build -trimpath -o "build/gitagger-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}" ./cmd/gitagger
       - name: upload binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: gitagger-${{ matrix.goos }}-${{ matrix.goarch }}
           path: build/gitagger-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8160989..a6b76a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,8 +10,8 @@ jobs:
     name: build + vet + test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: build
@@ -24,7 +24,7 @@ jobs:
           go test ./... -v 2>&1 | tee logs/go-test.txt
       - name: upload test logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: go-test-logs
           path: logs/go-test.txt
@@ -33,8 +33,8 @@ jobs:
     name: ops scripts (bugcheck + seccheck)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: install lint tools
@@ -52,7 +52,7 @@ jobs:
         run: bash scripts/ops/go-seccheck.sh
       - name: upload ops logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ops-logs
           path: logs/
@@ -61,8 +61,8 @@ jobs:
     name: actionlint (repo + generated)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: install actionlint
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 00b34c2..b824f5b 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -13,14 +13,14 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
           
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: 3.x
           
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ed3c1e2..b80820b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -10,9 +10,9 @@ jobs:
     name: build + container tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
       # Optional: set the DOCKER_HUB_AUTH repo variable to 'true' plus
       # DOCKER_HUB_USERNAME + DOCKER_HUB_TOKEN secrets, and pulls use
       # your own quota instead of the shared runner quota. Without them
@@ -33,7 +33,7 @@ jobs:
         run: sh scripts/docker-test.sh gitagger:test
       - name: upload docker logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: docker-test-logs
           path: logs/docker-test.txt
diff --git a/.github/workflows/ghcr-docker.yml b/.github/workflows/ghcr-docker.yml
index fe360f0..6cc4d08 100644
--- a/.github/workflows/ghcr-docker.yml
+++ b/.github/workflows/ghcr-docker.yml
@@ -36,7 +36,7 @@ jobs:
     name: build and push image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - uses: docker/setup-qemu-action@v4
diff --git a/.github/workflows/gitagger.yml b/.github/workflows/gitagger.yml
index fffe40b..d662fbc 100644
--- a/.github/workflows/gitagger.yml
+++ b/.github/workflows/gitagger.yml
@@ -21,10 +21,10 @@ jobs:
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: Install goreleaser
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index c1ff456..85c5fc4 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -12,7 +12,7 @@ jobs:
     name: link check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: lycheeverse/lychee-action@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-cmd.yml b/.github/workflows/test-cmd.yml
index caa8537..a013f9f 100644
--- a/.github/workflows/test-cmd.yml
+++ b/.github/workflows/test-cmd.yml
@@ -15,10 +15,10 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: Build sandbox repo
diff --git a/.github/workflows/test-platforms.yml b/.github/workflows/test-platforms.yml
index 7877469..1c184f7 100644
--- a/.github/workflows/test-platforms.yml
+++ b/.github/workflows/test-platforms.yml
@@ -15,8 +15,8 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
       - name: full test suite
@@ -62,7 +62,7 @@ jobs:
           [ -z "$(git tag --list)" ] || { echo "tag not removed"; exit 1; }
       - name: upload platform logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: platform-logs-${{ matrix.os }}
           path: logs/