diff --git a/.github/actions/build-android/action.yml b/.github/actions/build-android/action.yml
index 09745676..f6b62ecc 100644
--- a/.github/actions/build-android/action.yml
+++ b/.github/actions/build-android/action.yml
@@ -53,7 +53,7 @@ runs:
       run: echo "version=$(sed -n 's/^toolchainVersion=//p' gradle/gradle-daemon-jvm.properties)" >> "$GITHUB_OUTPUT"
 
     - name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v6
       with:
         java-version: ${{ steps.jdk.outputs.version }}
         # AdoptOpenJDK became Eclipse Temurin; resolving "adopt" now fails
@@ -62,7 +62,7 @@ runs:
         cache: "gradle"
 
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v7
       with:
         go-version-file: "netbird/go.mod"
         cache-dependency-path: "netbird/go.sum"
@@ -74,7 +74,7 @@ runs:
 
     - name: Cache Android NDK
       id: ndk-cache
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         # ANDROID_HOME is set by the runner image but not visible to ${{ env.X }}
         # in composite actions; the ubuntu-latest image pins it to this path.
@@ -107,7 +107,7 @@ runs:
     # hit the cache, skip the install and leave the build without a generator.
     - name: Cache gomobile and gobind
       id: gomobile-cache
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: |
           ~/go/bin/gomobile
diff --git a/.github/workflows/build-debug.yml b/.github/workflows/build-debug.yml
index 61d46089..6084429a 100644
--- a/.github/workflows/build-debug.yml
+++ b/.github/workflows/build-debug.yml
@@ -17,9 +17,10 @@ jobs:
       bundle_path: ${{ steps.build.outputs.bundle_path }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Get short Git hash
         id: version
@@ -35,7 +36,7 @@ jobs:
           build_type: debug
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: debug-artifacts-${{ steps.version.outputs.version_name }}
           path: |
@@ -44,7 +45,7 @@ jobs:
           retention-days: 3
 
       - name: Upload AAR artifact for tests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: netbird-aar
           path: ${{ steps.build.outputs.aar_path }}
@@ -55,9 +56,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Read the daemon JDK version
         id: jdk
@@ -65,14 +67,14 @@ jobs:
         run: echo "version=$(sed -n 's/^toolchainVersion=//p' gradle/gradle-daemon-jvm.properties)" >> "$GITHUB_OUTPUT"
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: ${{ steps.jdk.outputs.version }}
           distribution: "temurin"
           cache: "gradle"
 
       - name: Download AAR artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: netbird-aar
           path: gomobile
@@ -82,7 +84,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: unit-test-results
           path: |
@@ -95,9 +97,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Read the daemon JDK version
         id: jdk
@@ -105,14 +108,14 @@ jobs:
         run: echo "version=$(sed -n 's/^toolchainVersion=//p' gradle/gradle-daemon-jvm.properties)" >> "$GITHUB_OUTPUT"
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           java-version: ${{ steps.jdk.outputs.version }}
           distribution: "temurin"
           cache: "gradle"
 
       - name: Download AAR artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: netbird-aar
           path: gomobile
@@ -140,7 +143,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: instrumented-test-results
           path: |
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index ec7d146a..1e65ba94 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -26,7 +26,7 @@ jobs:
       bundle_path: ${{ steps.build.outputs.bundle_path }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -91,7 +91,7 @@ jobs:
           build_type: release
 
       - name: Upload files to existing release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             ${{ steps.build.outputs.apk_path }}
diff --git a/.github/workflows/build-snapshot.yml b/.github/workflows/build-snapshot.yml
index 5358b967..48448885 100644
--- a/.github/workflows/build-snapshot.yml
+++ b/.github/workflows/build-snapshot.yml
@@ -21,7 +21,7 @@ jobs:
       NETBIRD_UPLOAD_STORE_PASSWORD: ${{ secrets.NETBIRD_UPLOAD_STORE_PASSWORD }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # git describe below needs the tags and the history down to the
           # nearest release tag; the default shallow clone carries neither.
@@ -100,7 +100,7 @@ jobs:
           build_type: release
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.version.outputs.version_name }}
           path: |
diff --git a/.github/workflows/bump-netbird.yml b/.github/workflows/bump-netbird.yml
index a7a7b175..25878143 100644
--- a/.github/workflows/bump-netbird.yml
+++ b/.github/workflows/bump-netbird.yml
@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
           token: ${{ secrets.NETBIRD_DEV_BOT_GITHUB_TOKEN }}