diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b292b0c31..8b056bc63 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,10 +28,10 @@ jobs:
         config: [x86_64-linux, arm64-linux]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: bazel-contrib/setup-bazel@0.19.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}-${{ matrix.config }}
diff --git a/.github/workflows/code_coverage.yml b/.github/workflows/code_coverage.yml
index 8d75225e5..722343987 100644
--- a/.github/workflows/code_coverage.yml
+++ b/.github/workflows/code_coverage.yml
@@ -24,7 +24,7 @@ on:
 
 jobs:
   cpp:
-    uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@ea19fcae9aeeb4ac678b750c6c197eaf75414f39 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@473c10b74361afb7506a5d35ea554030753d5594 # v0.0.0
     with:
       bazel-target: "//score/..."
       bazel-config: "x86_64-linux"
@@ -33,7 +33,7 @@ jobs:
       retention-days: 10
       min-coverage: 76
   rust:
-    uses: eclipse-score/cicd-workflows/.github/workflows/rust-coverage.yml@ea19fcae9aeeb4ac678b750c6c197eaf75414f39 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/rust-coverage.yml@473c10b74361afb7506a5d35ea554030753d5594 # v0.0.0
     with:
       bazel-test-targets: "//score/..."
       bazel-test-config-flags: "--config=x86_64-linux --config=ferrocene-coverage --lockfile_mode=error --test_lang_filters=-cc,-miri"
diff --git a/.github/workflows/docs-cleanup.yml b/.github/workflows/docs-cleanup.yml
index 846e9654f..0792ed7d6 100644
--- a/.github/workflows/docs-cleanup.yml
+++ b/.github/workflows/docs-cleanup.yml
@@ -24,6 +24,6 @@ on:
 
 jobs:
   docs-cleanup:
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-cleanup.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/gitlint.yml b/.github/workflows/gitlint.yml
index e4e667b52..49e940695 100644
--- a/.github/workflows/gitlint.yml
+++ b/.github/workflows/gitlint.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Run Gitlint Action
diff --git a/.github/workflows/license_check.yml b/.github/workflows/license_check.yml
index 65219c6a4..17cc05e24 100644
--- a/.github/workflows/license_check.yml
+++ b/.github/workflows/license_check.yml
@@ -25,7 +25,7 @@ permissions:
 
 jobs:
   license-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
       bazel-target: "run --lockfile_mode=error //:license-check"
diff --git a/.github/workflows/lint_clippy.yml b/.github/workflows/lint_clippy.yml
index 6070de955..d635cf1bb 100644
--- a/.github/workflows/lint_clippy.yml
+++ b/.github/workflows/lint_clippy.yml
@@ -25,12 +25,12 @@ jobs:
     timeout-minutes: 6 # 6 minutes is the maximum allowed for a cold run
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Cache Cargo registry, git deps & target
-        uses: actions/cache@v3
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/qnx8.yml b/.github/workflows/qnx8.yml
index e4b443a35..b40d85d59 100644
--- a/.github/workflows/qnx8.yml
+++ b/.github/workflows/qnx8.yml
@@ -35,7 +35,7 @@ jobs:
             bazel-test-target: >-
               //score/...
             extra-bazel-test-flags: "--test_timeout=120,600,1800,7200" # Increase test timeout due to QEMU emulation
-    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@af347722c7ae3ed85518895c11268d96ac728f62
+    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@473c10b74361afb7506a5d35ea554030753d5594
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 36afe9bf0..109475c01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,7 +57,7 @@ jobs:
       COVERAGE_ARCHIVE: ${{ github.event.repository.name }}-${{ inputs.tag }}-cpp-coverage
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Get Current Date and Previous Release Tag
         env:
           GH_TOKEN: ${{ github.token }}
@@ -88,7 +88,7 @@ jobs:
           printf '\n---\n\n## Changes to the Module\n\n' >> release_body.md
           sed -n '/^Changes to the Module$/,$p' "$LATEST_RELEASE_NOTE" | sed '1,2d' >> release_body.md
       - name: Download Coverage Report Artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ format('{0}_cpp_coverage{1}', github.event.repository.name, '_cpp') }}
           path: ${{ env.COVERAGE_ARCHIVE }}
@@ -97,7 +97,7 @@ jobs:
           tar --sort=name --owner=0 --group=0 --numeric-owner \
             -cJf "$COVERAGE_ARCHIVE.tar.xz" "$COVERAGE_ARCHIVE"
       - name: Create Draft Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         id: draft_release
         with:
           tag_name: ${{ inputs.tag }}
diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml
index 1403893fa..13dfd51a6 100644
--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -33,10 +33,10 @@ jobs:
         config: [asan_ubsan_lsan, tsan]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: bazel-contrib/setup-bazel@0.19.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}-${{ matrix.config }}
@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload test logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bazel-testlogs-${{ matrix.config }}-${{ github.run_id }}
           path: bazel-testlogs/
diff --git a/.github/workflows/test_and_docs.yml b/.github/workflows/test_and_docs.yml
index 8d790e9fd..c4dd425e7 100644
--- a/.github/workflows/test_and_docs.yml
+++ b/.github/workflows/test_and_docs.yml
@@ -32,14 +32,14 @@ on:
 
 jobs:
   docs-verify:
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-verify.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
     permissions:
       pull-requests: write
       contents: read
     with:
       bazel-docs-verify-target: "--lockfile_mode=error //:docs_check"
   run-tests:
-    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
     permissions:
       contents: read
       pull-requests: read
@@ -50,7 +50,7 @@ jobs:
   build-docs:
     needs: run-tests
     if: ${{ needs.run-tests.result == 'success' }}
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
     permissions:
       contents: write
       pages: write