diff --git a/.github/workflows/automatic-api-update.yaml b/.github/workflows/automatic-api-update.yaml
index d7304bf..c0d2c80 100644
--- a/.github/workflows/automatic-api-update.yaml
+++ b/.github/workflows/automatic-api-update.yaml
@@ -8,7 +8,7 @@ jobs:
     name: "Create PR for API update"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "actions/setup-node@v6"
       - name: "Update Buf Script"
         id: "buf-update"
@@ -31,7 +31,7 @@ jobs:
         if: "steps.buf-update.outputs.updated == 'true'"
         run: "buf generate"
       - name: "Create Pull Request"
-        uses: "peter-evans/create-pull-request@v8.1.0"
+        uses: "peter-evans/create-pull-request@v8.1.1"
         if: "steps.buf-update.outputs.updated == 'true'"
         with:
           delete-branch: "true"
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 307999f..8231389 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -23,7 +23,7 @@ jobs:
           - "3.10"
       fail-fast: false
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "bewuethr/yamllint-action@v1.3.0"
         with:
           config-file: ".yamllint"
@@ -46,13 +46,13 @@ jobs:
       matrix:
         language: ["python"]
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "authzed/actions/codeql@main"
   trivy:
     name: "Analyze with Trivy"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - name: "Run Trivy vulnerability scanner"
         uses: "aquasecurity/trivy-action@master"
         with:
@@ -72,7 +72,7 @@ jobs:
     name: "Type Check with Mypy"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "astral-sh/setup-uv@v7"
       - name: "mypy"
         run: "uv run --frozen mypy src/authzed"
@@ -82,5 +82,5 @@ jobs:
     runs-on: "depot-ubuntu-24.04-small"
     if: "github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' || github.event.action == 'edited')"
     steps:
-      - uses: "actions/checkout@v6"
-      - uses: "webiny/action-conventional-commits@v1.3.1"
+      - uses: "actions/checkout@v7"
+      - uses: "webiny/action-conventional-commits@v1.4.2"
diff --git a/.github/workflows/manual-api-update.yaml b/.github/workflows/manual-api-update.yaml
index 5eddb57..b22dc86 100644
--- a/.github/workflows/manual-api-update.yaml
+++ b/.github/workflows/manual-api-update.yaml
@@ -12,7 +12,7 @@ jobs:
     name: "Create PR for API update"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "actions/setup-node@v6"
       - name: "Update Buf Script"
         id: "buf-update"
@@ -35,7 +35,7 @@ jobs:
         if: "steps.buf-update.outputs.updated == 'true'"
         run: "buf generate"
       - name: "Create Pull Request"
-        uses: "peter-evans/create-pull-request@v8.1.0"
+        uses: "peter-evans/create-pull-request@v8.1.1"
         if: "steps.buf-update.outputs.updated == 'true'"
         with:
           delete-branch: "true"
diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml
index bfb52ea..e4652a1 100644
--- a/.github/workflows/publish-to-pypi.yml
+++ b/.github/workflows/publish-to-pypi.yml
@@ -14,7 +14,7 @@ jobs:
       # IMPORTANT: this permission is mandatory for Trusted Publishing
       id-token: "write"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "astral-sh/setup-uv@v7"
       # This gives us a version number without the release prefix
       - name: "Write release version"
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 99b42fc..841d985 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -30,7 +30,7 @@ jobs:
           - "3.13"
           - "3.14"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v7"
       - uses: "authzed/action-spicedb@v1"
         with:
           version: "latest"