diff --git a/.github/workflows/console-e2e.yml b/.github/workflows/console-e2e.yml
index 7eeaba6410..b72bcf941c 100644
--- a/.github/workflows/console-e2e.yml
+++ b/.github/workflows/console-e2e.yml
@@ -107,7 +107,7 @@ jobs:
       - name: Zip build artifacts
         run: zip -r build.zip .env/cache/database.pgdump .env/admin_api_key.txt data/lorawan-devices-index public ttn-lw-stack tools/bin/mage
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: build-files
           path: build.zip
@@ -140,7 +140,7 @@ jobs:
           sudo apt-get update
           sudo apt-get --only-upgrade install google-chrome-stable
           google-chrome --version
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v6
         name: Download build artifacts
         with:
           name: "build-files"
@@ -195,19 +195,19 @@ jobs:
             !cypress/e2e/smoke/smoke.spec.js
             ${{ steps.get-failed-spec.outputs.neg-failed-test }}
       - name: Upload logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: failure()
         with:
           name: logs
           path: .cache/devStack.log
       - name: Upload screenshots for failed tests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: failure()
         with:
           name: cypress-screenshots
           path: cypress/screenshots
       - name: Upload name of failing test
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: failure()
         with:
           name: cypress-failed-test-spec
@@ -232,7 +232,7 @@ jobs:
         uses: ./.github/actions/build-mage
       - name: Install Node and Dependencies
         uses: ./.github/actions/install-node-and-deps
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@v6
         name: Download build artifacts
         with:
           name: "build-files"
@@ -261,13 +261,13 @@ jobs:
           record: true
           spec: cypress/e2e/smoke/smoke.spec.js
       - name: Upload logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: failure()
         with:
           name: logs
           path: .cache/devStack.log
       - name: Upload screenshots for failed tests
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: failure()
         with:
           name: cypress-screenshots
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index f0f9e561ad..9391b9f968 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Check for diff
         run: tools/bin/mage git:diff
       - name: Lint code
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
           version: v2.1
           only-new-issues: true
@@ -83,7 +83,7 @@ jobs:
           args: -h postgres -U root ttn_lorawan_is_store_test
       - name: Configure AWS Credentials
         if: "${{ env.AWS_REGION != '' }}"
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-region: '${{ secrets.AWS_REGION }}'
           role-to-assume: 'arn:aws:iam::${{ secrets.AWS_USER_ID }}:role/${{ secrets.AWS_ROLE_NAME }}'
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 221124375f..a704a29671 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Add "needs/triage" label
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/pr-labels.yml b/.github/workflows/pr-labels.yml
index f4fda5ce65..ddeafcc46d 100644
--- a/.github/workflows/pr-labels.yml
+++ b/.github/workflows/pr-labels.yml
@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6
         if: ${{ github.event.pull_request.head.repo.full_name == github.repository && !startsWith(github.actor, 'dependabot') }}
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index c779f4c0b4..9f943959ed 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -56,7 +56,7 @@ jobs:
             git push origin v${{ steps.version.outputs.result }}
           fi
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v5
         with:
           aws-region: "${{ secrets.AWS_REGION }}"
           role-to-assume: "arn:aws:iam::${{ secrets.AWS_USER_ID }}:role/${{ secrets.AWS_ROLE_NAME }}"
diff --git a/.github/workflows/trigger-os-merge.yml b/.github/workflows/trigger-os-merge.yml
index fc0ddd4e73..e939fe577d 100644
--- a/.github/workflows/trigger-os-merge.yml
+++ b/.github/workflows/trigger-os-merge.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Trigger OS merge action in TTI repo
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.BOT_TOKEN }}
           script: |