diff --git a/.github/workflows/build_n_push.yml b/.github/workflows/build_n_push.yml
index 2f77a6a2..e03abfc4 100644
--- a/.github/workflows/build_n_push.yml
+++ b/.github/workflows/build_n_push.yml
@@ -29,13 +29,13 @@ jobs:
   docs_build_n_push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # Full history so gen:last-updated / gen:sitemap can read real
           # per-file commit dates (a shallow clone would yield wrong dates).
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
@@ -44,7 +44,7 @@ jobs:
         run: npm ci
 
       - name: Restore Next.js build cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .next/cache
           key: ${{ runner.os }}-nextjs-${{ hashFiles('package-lock.json') }}-${{ hashFiles('src/**', 'mdx/**', 'next.config.mjs') }}
@@ -56,13 +56,13 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: netbirdio/docs.netbird.io
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
@@ -71,7 +71,7 @@ jobs:
       # can leave this tag behind, but it cannot change :main (or another
       # mutable ref tag).
       - name: Docker build and publish immutable image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 79b62b29..003cfb70 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -15,7 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: codespell
         uses: codespell-project/actions-codespell@v2
         with:
diff --git a/.github/workflows/generate_api_pages.yml b/.github/workflows/generate_api_pages.yml
index d720be59..bb7d146d 100644
--- a/.github/workflows/generate_api_pages.yml
+++ b/.github/workflows/generate_api_pages.yml
@@ -32,7 +32,7 @@ jobs:
           input_string: ${{ github.event.inputs.tag }}
           version_extractor_regex: '\/v(.*)$'
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.DEV_GITHUB_TOKEN }}
 
@@ -53,7 +53,7 @@ jobs:
         run: curl -L -o generator/openapi/openapi.yml "https://raw.githubusercontent.com/netbirdio/netbird/v${{ steps.semver_parser.outputs.fullversion }}/shared/management/http/api/openapi.yml"
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: '1.25'
 
@@ -67,7 +67,7 @@ jobs:
         run: rm -rf src/pages/ipa/resources/*
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 2d5daca4..32bbcf9b 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -14,12 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          # The job runs PR-authored code (npm ci, npm run build); nothing in it
+          # talks to a remote, so no token needs to sit in the workspace.
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml
index c017cc97..8bb8605b 100644
--- a/.github/workflows/prod-deploy.yml
+++ b/.github/workflows/prod-deploy.yml
@@ -43,7 +43,7 @@ jobs:
           sleep 1
           done
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version: '1.21'