diff --git a/.github/workflows/build-global-renkulab-images.yml b/.github/workflows/build-global-renkulab-images.yml
index 46df557c03..8a5ebf70ac 100644
--- a/.github/workflows/build-global-renkulab-images.yml
+++ b/.github/workflows/build-global-renkulab-images.yml
@@ -35,31 +35,31 @@ jobs:
           - ttyd
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.DOCKER_PREFIX }}/py-${{ matrix.FLAVOR }}-${{ matrix.FRONTEND }}
           tags: |
             type=sha,prefix=${{ matrix.PLATFORM == 'linux/arm64' && 'arm64' || 'amd64' }}-
       - name: Docker meta cache
         id: meta_cache
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.DOCKER_PREFIX }}/py-${{ matrix.FLAVOR }}-${{ matrix.FRONTEND }}-cache
           tags: |
             type=raw,value=${{ matrix.PLATFORM == 'linux/arm64' && 'arm64' || 'amd64' }}
       - name: Setup pack
-        uses: buildpacks/github-actions/setup-pack@v5.9.3
+        uses: buildpacks/github-actions/setup-pack@v5.12.1
       - name: Build image
         working-directory: ./global-images
         run: |
@@ -106,18 +106,18 @@ jobs:
           - ttyd
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: index
         with:
@@ -131,14 +131,14 @@ jobs:
             type=semver,pattern={{version}},event=tag
       - name: Docker meta amd64
         id: meta_amd64
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.DOCKER_PREFIX }}/py-${{ matrix.FLAVOR }}-${{ matrix.FRONTEND }}
           tags: |
             type=sha,prefix=amd64-
       - name: Docker meta arm64
         id: meta_arm64
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.DOCKER_PREFIX }}/py-${{ matrix.FLAVOR }}-${{ matrix.FRONTEND }}
           tags: |
diff --git a/.github/workflows/create-release-branch.yml b/.github/workflows/create-release-branch.yml
index 8feaafaf56..1fed65f1b4 100644
--- a/.github/workflows/create-release-branch.yml
+++ b/.github/workflows/create-release-branch.yml
@@ -16,7 +16,7 @@ jobs:
   create-release-pr:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: "${{ secrets.RENKUBOT_GITHUB_TOKEN }}"
@@ -34,7 +34,7 @@ jobs:
           git commit -m "chore: create release ${{ github.event.inputs.version }}" --allow-empty
           git push
       - name: Create Pull Request
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.RENKUBOT_GITHUB_TOKEN }}
           script: |
@@ -60,7 +60,7 @@ jobs:
               issue_number: result.data.number,
               labels: ['release']
             });
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/publish-helm-chart.yml b/.github/workflows/publish-helm-chart.yml
index 429167bc4a..74d693abb2 100644
--- a/.github/workflows/publish-helm-chart.yml
+++ b/.github/workflows/publish-helm-chart.yml
@@ -9,13 +9,13 @@ jobs:
   publish-chart:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Set version
         id: vars
         run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
-      - uses: SwissDataScienceCenter/renku-actions/publish-chart@v1.23.0
+      - uses: SwissDataScienceCenter/renku-actions/publish-chart@v1.23.1
         env:
           CHART_DIR: helm-chart/
           CHART_NAME: renku
diff --git a/.github/workflows/publish-master-merges.yaml b/.github/workflows/publish-master-merges.yaml
index 0a6b65bb28..ed1ec8017e 100644
--- a/.github/workflows/publish-master-merges.yaml
+++ b/.github/workflows/publish-master-merges.yaml
@@ -14,10 +14,10 @@ jobs:
   publish-chart:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@v5
         with:
           version: "3.8.0"
         id: setup-helm
@@ -35,7 +35,7 @@ jobs:
       - id: set-version
         run: |
           echo "publish_version=${{ steps.bump-semver.outputs.new_version }}.$(echo ${{ github.sha }} | cut -c 1-7)" >> $GITHUB_ENV
-      - uses: SwissDataScienceCenter/renku-actions/publish-chart@v1.23.0
+      - uses: SwissDataScienceCenter/renku-actions/publish-chart@v1.23.1
         env:
           CHART_DIR: helm-chart/
           CHART_TAG: "--tag ${{env.publish_version}}"
diff --git a/.github/workflows/pull-request-test.yml b/.github/workflows/pull-request-test.yml
index af65b70750..26dd232a52 100644
--- a/.github/workflows/pull-request-test.yml
+++ b/.github/workflows/pull-request-test.yml
@@ -26,7 +26,7 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
     steps:
       # For pull requests it's not necessary to check out the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -43,9 +43,9 @@ jobs:
         working-directory: docs/
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm
@@ -77,7 +77,7 @@ jobs:
       extra-values: ${{ steps.deploy-comment.outputs.extra-values }}
     steps:
       - id: deploy-comment
-        uses: SwissDataScienceCenter/renku-actions/check-pr-description@v1.23.0
+        uses: SwissDataScienceCenter/renku-actions/check-pr-description@v1.23.1
         with:
           pr_ref: ${{ github.event.number }}
 
@@ -90,10 +90,10 @@ jobs:
       id-token: write
     if: github.event.action != 'closed'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Find deployment url
         if: needs.check-deploy.outputs.deploy == 'true'
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4
         id: deploymentUrlMessage
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -103,7 +103,7 @@ jobs:
       - name: Create comment deployment url
         if: steps.deploymentUrlMessage.outputs.comment-id == 0 &&
           needs.check-deploy.outputs.deploy == 'true'
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         with:
           token: ${{ secrets.RENKUBOT_GITHUB_TOKEN }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -112,13 +112,13 @@ jobs:
 
       - name: Azure login
         if: needs.check-deploy.outputs.deploy == 'true'
-        uses: azure/login@v2
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.CI_RENKU_AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.CI_RENKU_AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.CI_RENKU_AZURE_SUBSCRIPTION_ID }}
 
-      - uses: azure/aks-set-context@v4
+      - uses: azure/aks-set-context@v5
         if: needs.check-deploy.outputs.deploy == 'true'
         with:
           resource-group: "renku-dev"
@@ -132,7 +132,7 @@ jobs:
 
       - name: renku build and deploy
         if: needs.check-deploy.outputs.deploy == 'true'
-        uses: SwissDataScienceCenter/renku-actions/deploy-renku@v1.23.0
+        uses: SwissDataScienceCenter/renku-actions/deploy-renku@v1.23.1
         env:
           DOCKER_PASSWORD: ${{ secrets.RENKU_DOCKER_PASSWORD }}
           DOCKER_USERNAME: ${{ secrets.RENKU_DOCKER_USERNAME }}
@@ -174,7 +174,7 @@ jobs:
             sessions,
           ]
     steps:
-      - uses: SwissDataScienceCenter/renku-actions/test-renku-cypress@v1.23.0
+      - uses: SwissDataScienceCenter/renku-actions/test-renku-cypress@v1.23.1
         if: github.event.action != 'closed' && needs.check-deploy.outputs.deploy == 'true' && needs.check-deploy.outputs.test-enabled == 'true'
         with:
           e2e-folder: cypress/e2e/v2/
@@ -200,14 +200,14 @@ jobs:
         tests: [sessions, sessionSecrets]
     steps:
       - name: Azure login
-        uses: azure/login@v2
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.CI_RENKU_AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.CI_RENKU_AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.CI_RENKU_AZURE_SUBSCRIPTION_ID }}
 
       - name: Set AKS context
-        uses: azure/aks-set-context@v4
+        uses: azure/aks-set-context@v5
         with:
           resource-group: "renku-dev"
           cluster-name: "aks-switzerlandnorth-renku-dev"
@@ -218,7 +218,7 @@ jobs:
           chmod 400 "${{ github.workspace }}/renkubot-kube.config"
 
       - name: Install kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@v5
         with:
           version: "latest"
 
@@ -226,7 +226,7 @@ jobs:
         run: kubectl get pods -A
 
       - name: Run Cypress slow tests
-        uses: SwissDataScienceCenter/renku-actions/test-renku-cypress@v1.23.0
+        uses: SwissDataScienceCenter/renku-actions/test-renku-cypress@v1.23.1
         with:
           e2e-folder: cypress/e2e/slow/
           e2e-target: ${{ matrix.tests }}
@@ -253,7 +253,7 @@ jobs:
           || needs.check-deploy.outputs.renku-data-services != null
           )
           }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: core.setFailed('Cannot merge release PR if it still has custom versions in deploy string.')
 
@@ -267,7 +267,7 @@ jobs:
       id-token: write
     steps:
       - name: Find deployment url
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4
         id: deploymentUrlMessage
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -275,7 +275,7 @@ jobs:
           body-includes: "Tearing down the temporary RenkuLab deployment"
       - name: Create comment deployment url
         if: steps.deploymentUrlMessage.outputs.comment-id == 0
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         with:
           token: ${{ secrets.RENKUBOT_GITHUB_TOKEN }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -285,13 +285,13 @@ jobs:
       # Azure-specific setup
       - name: Azure login
         if: needs.check-deploy.outputs.deploy == 'true'
-        uses: azure/login@v2
+        uses: azure/login@v3
         with:
           client-id: ${{ secrets.CI_RENKU_AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.CI_RENKU_AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.CI_RENKU_AZURE_SUBSCRIPTION_ID }}
 
-      - uses: azure/aks-set-context@v4
+      - uses: azure/aks-set-context@v5
         if: needs.check-deploy.outputs.deploy == 'true'
         with:
           resource-group: "renku-dev"
@@ -305,7 +305,7 @@ jobs:
 
       # Cleanup Azure deployments
       - name: renku teardown
-        uses: SwissDataScienceCenter/renku-actions/cleanup-renku-ci-deployments@v1.23.0
+        uses: SwissDataScienceCenter/renku-actions/cleanup-renku-ci-deployments@v1.23.1
         env:
           HELM_RELEASE_REGEX: "^ci-renku-${{ github.event.number }}$"
           KUBECONFIG: "${{ github.workspace }}/renkubot-kube.config"
diff --git a/.github/workflows/release-test.yml b/.github/workflows/release-test.yml
index 6f069d9bf3..493b45e755 100644
--- a/.github/workflows/release-test.yml
+++ b/.github/workflows/release-test.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Check unmerged PRs
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const prs = await github.rest.pulls.list({