diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index 5bc7338..9372ff9 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -16,12 +16,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version: '1.25.12'
 
       - name: Download dependencies
         run: go mod download
@@ -71,14 +71,14 @@ jobs:
       id-token: write  # Required for keyless cosign signing via GitHub OIDC
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version: '1.25.12'
 
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index eb06991..2b41e40 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Build with Jekyll
         uses: actions/jekyll-build-pages@v1
@@ -36,7 +36,7 @@ jobs:
           destination: ./_site
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
 
   deploy:
     environment:
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index e94b778..e50d42e 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -13,11 +13,11 @@ jobs:
     name: Vulnerability Scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version: '1.25.12'
 
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest