diff --git a/.github/workflows/mkdocs.yaml b/.github/workflows/mkdocs.yaml
index 731f35bb..8335b270 100644
--- a/.github/workflows/mkdocs.yaml
+++ b/.github/workflows/mkdocs.yaml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Rust (nightly for rustdoc JSON)
         uses: dtolnay/rust-toolchain@nightly
@@ -42,7 +42,7 @@ jobs:
           cache-dependency-glob: assets/sites/uv.lock
 
       - name: Install typst
-        uses: typst-community/setup-typst@v4
+        uses: typst-community/setup-typst@v5
 
       - name: Setup pages
         uses: actions/configure-pages@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 82ba5a58..32629474 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -205,11 +205,11 @@ jobs:
           # Windows aarch: todo
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: true
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -291,7 +291,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions: write-all
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -365,7 +365,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [compile]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 003bece6..b53334a4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
           - beta
           - nightly
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: cachix/install-nix-action@v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable