diff --git a/.github/workflows/build-devcontainer-template.yml b/.github/workflows/build-devcontainer-template.yml
index 19f55b3b..d9909243 100644
--- a/.github/workflows/build-devcontainer-template.yml
+++ b/.github/workflows/build-devcontainer-template.yml
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
           submodules: false
@@ -74,10 +74,10 @@ jobs:
           tool-cache: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build devcontainer image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .devcontainer
           load: true
diff --git a/.github/workflows/build-targets-template.yml b/.github/workflows/build-targets-template.yml
index d76fcd5d..a6a2ff31 100644
--- a/.github/workflows/build-targets-template.yml
+++ b/.github/workflows/build-targets-template.yml
@@ -97,7 +97,7 @@ jobs:
           echo "CCACHE_DIR=$RUNNER_TEMP/.ccache" >> "$GITHUB_ENV"
 
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
           submodules: false
@@ -153,7 +153,7 @@ jobs:
 
       # Restore ccache across runs. Cache key includes compiler id+version, CIRCT sha, CMake build type, and build/cmake/circt.cmake hash.
       - name: Restore ccache
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ env.CCACHE_DIR }}
           key: >
@@ -173,7 +173,7 @@ jobs:
           enable-stack: false
 
       - name: Cache ghcup & cabal store
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.ghcup
@@ -186,14 +186,14 @@ jobs:
         run: cabal update
 
       - name: Init ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
+        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
         with:
           max-size: ${{ env.CCACHE_MAXSIZE }}
           verbose: 1
 
       - name: Install Verilator
         if: runner.os == 'Linux'
-        uses: veryl-lang/setup-verilator@b155747595eb4b817473a83045ba1da581c4084b # v1.0.3
+        uses: veryl-lang/setup-verilator@7464f6aacf42efab9a92b9138e9ce16ff1135f69 # v2.0.0
         with:
           version: '5.040'
 
@@ -378,7 +378,7 @@ jobs:
 
       - name: Upload artifacts
         if: ${{ inputs.artifact-name != '' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.artifact-path }}
diff --git a/.github/workflows/nightly-prerelease.yml b/.github/workflows/nightly-prerelease.yml
index bd0d2ca0..217a4da8 100644
--- a/.github/workflows/nightly-prerelease.yml
+++ b/.github/workflows/nightly-prerelease.yml
@@ -23,7 +23,7 @@ jobs:
       has-changes: ${{ steps.check.outputs.has-changes }}
     steps:
       # Sparse checkout of only the VERSION file
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           sparse-checkout: |
@@ -115,7 +115,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
       - name: Flatten artifact layout
@@ -131,7 +131,7 @@ jobs:
           cd out
           for f in *; do [ -f "$f" ] || continue; shasum -a 256 "$f" > "$f.sha256"; done
       - name: Create/Update prerelease
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           name: Nightly ${{ needs.prepare.outputs.date }}
diff --git a/.github/workflows/publish-libdoc.yml b/.github/workflows/publish-libdoc.yml
index 47c80372..8d7b4169 100644
--- a/.github/workflows/publish-libdoc.yml
+++ b/.github/workflows/publish-libdoc.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Download library docs artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: 'library-docs-${{ github.sha }}'
           path: library-docs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9f966d1b..2f4330ba 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       extra_args: ${{ steps.v.outputs.extra_args }}
       artifact_prefix: ${{ steps.v.outputs.artifact_prefix }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           submodules: false
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
       - name: Flatten artifact layout
@@ -116,7 +116,7 @@ jobs:
           cd out
           for f in *; do [ -f "$f" ] || continue; shasum -a 256 "$f" > "$f.sha256"; done
       - name: Publish GitHub Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           name: ${{ needs.prepare.outputs.tag }}