diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt
index dae2f4642..6f4d2b668 100644
--- a/.github/actions-lock.txt
+++ b/.github/actions-lock.txt
@@ -1,15 +1,15 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
-ed8f08fe0c056080f6afef29f15b2d49 appstore-build-publish.yml
-e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml
+2afe22a01c1c2413f0cf48d010a13396 appstore-build-publish.yml
+c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml
 2581a67c5bcdcd570427e6d51db767d7 fixup.yml
-dc0ae733f35c60274937c2647c027d46 lint-eslint.yml
+3ebb059d675980d618b9727fb3792d00 lint-eslint.yml
 43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml
 79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml
 300be6a756abda800e40850918f2d964 lint-php.yml
-ab3a506506b1d7c1cea9593ecfd84366 lint-stylelint.yml
-d5f511793e785e83842609afc0317b24 node-test.yml
-b45e44d9ffe39586b38b6a925c1a9740 openapi.yml
+d35c01a3f110e52eed0e0c422747a417 lint-stylelint.yml
+114bbea1108739b7dd46888e42691563 node-test.yml
+1a869a2906ae6d57be06ed83062687ce openapi.yml
 6d8eebf482b2932971b7912139f16d9f phpunit-mariadb.yml
 3cacf28a710b387e83d3858af40b7ffe phpunit-mysql.yml
 f89c18551d6a29af9bca63a0fd30a039 phpunit-oci.yml
@@ -19,5 +19,5 @@ aaa395a26591445ccf4c8196d7f01ee7 pr-feedback.yml
 6c355cb7b5d4da4d56a58e6d7f82881b psalm-matrix.yml
 c2fc57f15bc64e5066b79a398021ca1a rector-apply.yml
 2dbec18233063b42f4d8e03bbb43671c reuse.yml
-b47a9fe981a7435caea92db33f5ad121 sync-workflow-templates.yml
-4937ebfd80117c0133473d8ef51d8802 playwright.yml
+511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml
+28c2966d33e8181bfdbb7b6fbaf9b645 playwright.yml
diff --git a/.github/workflows/appstore-build-publish.yml b/.github/workflows/appstore-build-publish.yml
index 699f6d691..ba35bd80a 100644
--- a/.github/workflows/appstore-build-publish.yml
+++ b/.github/workflows/appstore-build-publish.yml
@@ -59,7 +59,7 @@ jobs:
           expression: "//info//dependencies//nextcloud/@min-version"
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml
index 76340acb5..eaa1e9f28 100644
--- a/.github/workflows/dependabot-approve-merge.yml
+++ b/.github/workflows/dependabot-approve-merge.yml
@@ -9,7 +9,7 @@
 name: Auto approve Dependabot PRs
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
+  pull_request:
     branches:
       - main
       - master
diff --git a/.github/workflows/lint-eslint.yml b/.github/workflows/lint-eslint.yml
index 5ad2d20e5..317e3c675 100644
--- a/.github/workflows/lint-eslint.yml
+++ b/.github/workflows/lint-eslint.yml
@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
           fallbackNode: '^24'
diff --git a/.github/workflows/lint-stylelint.yml b/.github/workflows/lint-stylelint.yml
index e4b26b585..89149dd4e 100644
--- a/.github/workflows/lint-stylelint.yml
+++ b/.github/workflows/lint-stylelint.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
           fallbackNode: '^24'
diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml
index 1b74d3e4e..c25b088f4 100644
--- a/.github/workflows/node-test.yml
+++ b/.github/workflows/node-test.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
           fallbackNode: '^24'
@@ -93,7 +93,7 @@ jobs:
         run: npm run test:coverage --if-present
 
       - name: Collect coverage
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           files: ./coverage/lcov.info
 
diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index 748565611..f8a146097 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 95ebdc966..7a9d98f27 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -30,7 +30,7 @@ on:
   pull_request:
     branches:
       - main
-      - stable5.3
+      - stable5.4
 
 permissions:
   contents: read
@@ -137,4 +137,4 @@ jobs:
 
     steps:
       - name: Summary status
-        run: if ${{ needs.playwright-tests.result != 'success' }}; then exit 1; fi
\ No newline at end of file
+        run: if ${{ needs.playwright-tests.result != 'success' }}; then exit 1; fi
diff --git a/.github/workflows/playwright.yml.patch b/.github/workflows/playwright.yml.patch
index 2563e4c01..d14e79fd1 100644
--- a/.github/workflows/playwright.yml.patch
+++ b/.github/workflows/playwright.yml.patch
@@ -11,7 +11,7 @@ index c218bffb..1e0028ab 100644
 -      - stable34
 -      - stable33
 +      - main
-+      - stable5.3
++      - stable5.4
  
  permissions:
    contents: read
diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml
index e7094c713..b43db987d 100644
--- a/.github/workflows/sync-workflow-templates.yml
+++ b/.github/workflows/sync-workflow-templates.yml
@@ -26,7 +26,7 @@ jobs:
       matrix:
         branches:
           - ${{ github.event.repository.default_branch }}
-          - 'stable5.3'
+          - 'stable5.4'
 
     name: Update workflows in ${{ matrix.branches }}
 
diff --git a/.github/workflows/sync-workflow-templates.yml.patch b/.github/workflows/sync-workflow-templates.yml.patch
index acd8db0c6..6ac7e45bf 100644
--- a/.github/workflows/sync-workflow-templates.yml.patch
+++ b/.github/workflows/sync-workflow-templates.yml.patch
@@ -6,10 +6,10 @@ index 85090be9..cf08bd3e 100644
        matrix:
          branches:
            - ${{ github.event.repository.default_branch }}
+-          - 'stable35'
 -          - 'stable34'
 -          - 'stable33'
--          - 'stable32'
-+          - 'stable5.3'
++          - 'stable5.4'
  
      name: Update workflows in ${{ matrix.branches }}