diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 7200af05..c55dfffb 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -54,13 +54,13 @@ jobs:
     runs-on: ${{ matrix.platform == 'linux-amd64' && 'ubuntu-24.04' || matrix.platform == 'linux-arm64' && 'ubuntu-24.04-arm' }}
     name: "Build platform ${{ matrix.platform }} golang ${{ matrix.go-version }} privilege ${{ matrix.privilege-level }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Clean disk space
         uses: ./.github/actions/clean-runner
-      - uses: benjlevesque/short-sha@v2.1
+      - uses: benjlevesque/short-sha@v3.0
         id: short-sha
       - name: Set up golang ${{ matrix.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
       - name: Setup Environment
@@ -123,14 +123,14 @@ jobs:
         run: |
           make publish-stacker-bin
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ (matrix.privilege-level == 'priv') }}
         with:
           # if there is more than 1 go-version, we would need to account for that here.
           name: stacker-${{ matrix.platform }}
           path: stacker-${{ matrix.platform }}
           if-no-files-found: error
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         id: restore-build
         with:
           path: stacker-${{ matrix.platform }}
diff --git a/.github/workflows/cloc.yml b/.github/workflows/cloc.yml
index 7597bb1c..41b67bb0 100644
--- a/.github/workflows/cloc.yml
+++ b/.github/workflows/cloc.yml
@@ -18,11 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: 1.25.10
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 13779955..b8480083 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -43,10 +43,10 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     - name: Install go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: 1.25.10
 
diff --git a/.github/workflows/commit-msg.yaml b/.github/workflows/commit-msg.yaml
index 9e90e1ba..3cc5ba30 100644
--- a/.github/workflows/commit-msg.yaml
+++ b/.github/workflows/commit-msg.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Check Commit Type
         uses: gsactions/commit-message-checker@v2
         with:
diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 568e0670..12a16db5 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -50,13 +50,13 @@ jobs:
         privilege-level: ${{fromJson(inputs.privilege-level)}}
     name: "golang ${{ matrix.go-version }} privilege ${{ matrix.privilege-level }}"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Clean disk space
         uses: ./.github/actions/clean-runner
-      - uses: benjlevesque/short-sha@v2.1
+      - uses: benjlevesque/short-sha@v3.0
         id: short-sha
       - name: Set up golang ${{ matrix.go-version }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go-version }}
       - name: Setup Environment
@@ -110,14 +110,14 @@ jobs:
           token: ${{ secrets.codecov_token }}
           files: coverage-${{ matrix.privilege-level}}.txt
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: ${{ (matrix.privilege-level == 'priv') }}
         with:
           # if there is more than 1 go-version, we would need to account for that here.
           name: binary-cov
           path: stacker
           if-no-files-found: error
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         id: restore-build
         with:
           path: stacker
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 371f470a..dd515645 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -11,9 +11,9 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
     - name: Set up Python 3.x
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: '3.x'
     - name: Check DCO
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3cf72539..7302f1db 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -11,8 +11,8 @@ jobs:
     outputs:
       build-id: ${{steps.build-id.outputs.build-id}}
     steps:
-      - uses: actions/checkout@v4
-      - uses: benjlevesque/short-sha@v2.1
+      - uses: actions/checkout@v7
+      - uses: benjlevesque/short-sha@v3.0
         id: short-sha
       - id: build-id
         run: echo "build-id=${{ github.event.release.tag_name }}-${{ steps.short-sha.outputs.sha }}" >> "$GITHUB_OUTPUT"
@@ -39,7 +39,7 @@ jobs:
     # needs ci for the cached stacker binary
     needs: [build-id, ci]
     steps:
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         id: restore-build
         with:
           path: stacker-${{ matrix.platform }}
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 105ec0b7..b4b26c5b 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
           stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'