diff --git a/.github/workflows/01-make-dist-worker.yml b/.github/workflows/01-make-dist-worker.yml
index bb43f2ba04..6535db4b4b 100644
--- a/.github/workflows/01-make-dist-worker.yml
+++ b/.github/workflows/01-make-dist-worker.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         # NOTE: This is the unprivileged part of the GHA-01-tarballs ritual,
         #  running potentially untrusted shell code from the PR source branch.
@@ -128,7 +128,7 @@ jobs:
     - name: Prepare ccache
       # Based on https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#example-using-the-cache-action example
       id: cache-ccache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       env:
         compiler: 'CC=gcc CXX=g++'
         cache-name: cache-ccache-${{ env.compiler }}
diff --git a/.github/workflows/01-make-dist.yml b/.github/workflows/01-make-dist.yml
index 6b1158035a..cad910e193 100644
--- a/.github/workflows/01-make-dist.yml
+++ b/.github/workflows/01-make-dist.yml
@@ -104,7 +104,7 @@ jobs:
     # We need to find the artifact URL and report it below.
     - name: Get Artifact URL
       id: get_artifact_url
-      uses: actions/github-script@v6
+      uses: actions/github-script@v9
       with:
           script: |
               const res = await github.rest.actions.listArtifactsForRepo({
@@ -136,7 +136,7 @@ jobs:
     # (at least 12MB as of Nov 2025).
     - if: env.GITHUB_REF_TYPE != 'tag' && steps.subst-github-ref-name.outputs.result != 'master'
       name: Delete Old Artifacts for this feature branch/PR
-      uses: actions/github-script@v6
+      uses: actions/github-script@v9
       id: delete_old_artifact_for_pr
       continue-on-error: true
       with:
diff --git a/.github/workflows/05-codeql.yml b/.github/workflows/05-codeql.yml
index c5572d1768..4cd232709f 100644
--- a/.github/workflows/05-codeql.yml
+++ b/.github/workflows/05-codeql.yml
@@ -65,7 +65,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
 
     # Using hints from https://askubuntu.com/questions/272248/processing-triggers-for-man-db
     - if: matrix.language == 'cpp' && matrix.os == 'ubuntu-latest'
@@ -81,7 +81,7 @@ jobs:
     - name: Prepare ccache
       # Based on https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#example-using-the-cache-action example
       id: cache-ccache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       env:
         cache-name: cache-ccache-${{ matrix.compiler }}-${{ matrix.NUT_SSL_VARIANTS }}-${{ matrix.NUT_USB_VARIANTS }}
       with:
@@ -113,7 +113,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -129,7 +129,7 @@ jobs:
     # https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     - if: matrix.build-mode == 'autobuild'
       name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -182,6 +182,6 @@ jobs:
       run: ccache -sv || ccache -s || echo "FAILED to read ccache info, oh well"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/08-PyNUTClient.yml b/.github/workflows/08-PyNUTClient.yml
index ef4dff4829..5ea8bcb879 100644
--- a/.github/workflows/08-PyNUTClient.yml
+++ b/.github/workflows/08-PyNUTClient.yml
@@ -30,7 +30,7 @@ jobs:
         fetch-depth: 0
         fetch-tags: true
     - name: Set up Python 3.13
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v6
       with:
         python-version: '3.13'
     - name: Extract python interpreter path name