diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index 54a7a6e33..f47bffdf8 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: 🛡️ Harden Runner
         if: github.repository_owner == 'eclipse-score'
-        uses: step-security/harden-runner@v2.18.0
+        uses: step-security/harden-runner@v2.20.1
         with:
           egress-policy: audit
 
@@ -31,13 +31,13 @@ jobs:
           cache: false
 
       - name: Checkout repository (Handle all events)
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
       - name: Setup Bazel with shared caching
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: bazel-contrib/setup-bazel@0.19.0
         with:
           disk-cache: true
           repository-cache: true
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 045730b8f..a16cde45f 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -37,4 +37,4 @@ on:
 
 jobs:
   maintenance:
-    uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@829b3e11ccbf924a5782f7bfed647cb1619fdf78 # v0.0.1
+    uses: eclipse-score/cicd-workflows/.github/workflows/daily.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml
index a045828cf..5ca054d31 100644
--- a/.github/workflows/docs-publish.yml
+++ b/.github/workflows/docs-publish.yml
@@ -21,7 +21,7 @@ on:
 jobs:
   docs-deploy:
     if: github.event.workflow_run.conclusion == 'success'
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs-publish.yml@206a795e30d45de82d541206fde17abe98d2b4bf
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs-publish.yml@840a5c60b35c713ed8df13f1969dfb3721a5c529
     permissions:
       actions: read
       contents: write
diff --git a/.github/workflows/downstream_compatibility.yml b/.github/workflows/downstream_compatibility.yml
index 103bcc453..c3a6c338f 100644
--- a/.github/workflows/downstream_compatibility.yml
+++ b/.github/workflows/downstream_compatibility.yml
@@ -43,7 +43,7 @@ jobs:
     steps:
       - name: 🛡️ Harden Runner
         if: github.repository_owner == 'eclipse-score'
-        uses: step-security/harden-runner@v2.18.0
+        uses: step-security/harden-runner@v2.20.1
         with:
           egress-policy: audit
 
@@ -54,7 +54,7 @@ jobs:
           cache: false
 
       - name: Checkout PR
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7
 
       - name: Prepare Python
         run: bazel run //:ide_support
diff --git a/.github/workflows/license_check.yml b/.github/workflows/license_check.yml
index 6540bfc8c..914e1fec8 100644
--- a/.github/workflows/license_check.yml
+++ b/.github/workflows/license_check.yml
@@ -25,7 +25,7 @@ permissions:
 
 jobs:
   license-check:
-    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
+    uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@93aac16ada7d247bbb6ae926509ddea74cf5213a # v0.0.2
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
       bazel-target: "run --lockfile_mode=error //src:license-check"
diff --git a/.github/workflows/link_check.yml b/.github/workflows/link_check.yml
index 73502c0c2..f33eec41d 100644
--- a/.github/workflows/link_check.yml
+++ b/.github/workflows/link_check.yml
@@ -28,11 +28,11 @@ jobs:
     steps:
       - name: 🛡️ Harden Runner
         if: github.repository_owner == 'eclipse-score'
-        uses: step-security/harden-runner@v2.18.0
+        uses: step-security/harden-runner@v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run link check action
         uses: ./.github/actions/link-check
diff --git a/.github/workflows/on-pr.yml b/.github/workflows/on-pr.yml
index ed4b18632..a2b0742da 100644
--- a/.github/workflows/on-pr.yml
+++ b/.github/workflows/on-pr.yml
@@ -35,7 +35,7 @@ jobs:
 
   docs-build:
     needs: [unit-tests]
-    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@206a795e30d45de82d541206fde17abe98d2b4bf
+    uses: eclipse-score/cicd-workflows/.github/workflows/docs.yml@840a5c60b35c713ed8df13f1969dfb3721a5c529
     with:
       bazel-target: "//:docs"
       tests-report-artifact: tests-report
diff --git a/.github/workflows/test_links.yml b/.github/workflows/test_links.yml
index faa4a8ff2..cd05a23f0 100644
--- a/.github/workflows/test_links.yml
+++ b/.github/workflows/test_links.yml
@@ -23,11 +23,11 @@ jobs:
     steps:
       - name: 🛡️ Harden Runner
         if: github.repository_owner == 'eclipse-score'
-        uses: step-security/harden-runner@v2.18.0
+        uses: step-security/harden-runner@v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7
 
       # Run your link checker and generate log
       - name: Run LinkChecker
@@ -53,7 +53,7 @@ jobs:
       # Upload issue body artifact if present
       - name: Upload issue body
         if: steps.detect.outputs.issue_needed == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: issue-body
           path: issue_body.md
@@ -64,12 +64,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download issue body artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: issue-body
 
       - name: Create GitHub issue from findings
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |