diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 70b93cca..10c01a06 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -20,12 +20,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           lfs: true
 
       - name: Set up NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload static files as artifact
         id: deployment
-        uses: actions/upload-pages-artifact@v3 # or specific "vX.X.X" version tag for this action
+        uses: actions/upload-pages-artifact@v5 # or specific "vX.X.X" version tag for this action
         with:
           path: docs/src/.vitepress/dist
 
@@ -67,4 +67,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml
index 8bb6cb5d..2af51725 100644
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -22,41 +22,41 @@ jobs:
       packages: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.25"
 
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Login to Docker Hub
         if: ${{ !inputs.snapshot }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GHCR
         if: ${{ !inputs.snapshot }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -73,7 +73,7 @@ jobs:
           HOMEBREW_GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
 
       - name: Upload Build Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-builds
           path: |
@@ -89,12 +89,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: release-builds
 
@@ -154,14 +154,14 @@ jobs:
 
       - name: Upload Installers as Artifacts
         if: ${{ inputs.snapshot }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: backrest-snapshot-installers
           path: windows_installers\*.exe
 
       - name: Upload Installers to Release
         if: ${{ !inputs.snapshot && startsWith(github.ref, 'refs/tags/') }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             ./windows_installers/*
@@ -175,14 +175,14 @@ jobs:
       matrix:
         goarch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
           go-version: "1.25"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         with:
           version: 9
       - name: Build web UI
@@ -221,12 +221,12 @@ jobs:
           zip -r "backrest_Darwin_${{ steps.arch.outputs.name }}.zip" Backrest.app
       - name: Upload as artifact
         if: ${{ inputs.snapshot }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: backrest-macos-${{ steps.arch.outputs.name }}
           path: "backrest_Darwin_${{ steps.arch.outputs.name }}.zip"
       - name: Upload to release
         if: ${{ !inputs.snapshot && startsWith(github.ref, 'refs/tags/') }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: "backrest_Darwin_${{ steps.arch.outputs.name }}.zip"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index abb6be83..613ada6c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,10 +18,10 @@ jobs:
   test-nix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.24"
 
@@ -45,15 +45,15 @@ jobs:
     env:
       TZ: UTC
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: pnpm
@@ -75,20 +75,20 @@ jobs:
       # Not RCLONE_*: rclone reads RCLONE_VERSION as its --version flag.
       E2E_RCLONE_VERSION: v1.69.1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.24"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 9
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: pnpm
@@ -108,13 +108,13 @@ jobs:
       # Keyed on the file that pins RequiredResticVersion; global-setup
       # provisions restic into this directory on a cache miss.
       - name: Cache restic
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: webui/e2e/.cache/restic-data
           key: restic-e2e-${{ hashFiles('internal/resticinstaller/resticinstaller.go') }}
 
       - name: Cache playwright browsers
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ hashFiles('webui/pnpm-lock.yaml') }}
@@ -126,7 +126,7 @@ jobs:
       # e2e spec skips itself if rclone is absent, so provision it for coverage.
       - name: Cache rclone
         id: cache-rclone
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: webui/e2e/.cache/rclone-bin
           key: rclone-${{ env.E2E_RCLONE_VERSION }}
@@ -149,7 +149,7 @@ jobs:
           E2E_SKIP_WEBUI_BUILD=1 E2E_BACKREST_BIN=$PWD/e2e/.cache/backrest pnpm run e2e
 
       - name: Upload playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: playwright-report
@@ -160,10 +160,10 @@ jobs:
   test-win:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v7
         with:
           go-version: "1.24"
 
@@ -184,7 +184,7 @@ jobs:
 
       - name: Cache restic
         id: cache-restic
-        uses: actions/cache@v3
+        uses: actions/cache@v6
         with:
           path: restic-bin
           key: restic-windows-${{ env.RESTIC_VERSION }}
diff --git a/.github/workflows/update-restic.yml b/.github/workflows/update-restic.yml
index b5b7f08c..9f024786 100644
--- a/.github/workflows/update-restic.yml
+++ b/.github/workflows/update-restic.yml
@@ -16,14 +16,14 @@ jobs:
   update-restic-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: Check for updates
         run: |
           ./scripts/update-restic-version.sh
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "chore: update restic version"