diff --git a/.github/workflows/build-commit0-images.yml b/.github/workflows/build-commit0-images.yml
index b45d11351..73f372ad8 100644
--- a/.github/workflows/build-commit0-images.yml
+++ b/.github/workflows/build-commit0-images.yml
@@ -128,7 +128,7 @@ jobs:
             echo "Using triggering ref (default)"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/build-gaia-images.yml b/.github/workflows/build-gaia-images.yml
index ef19a356d..71d43983f 100644
--- a/.github/workflows/build-gaia-images.yml
+++ b/.github/workflows/build-gaia-images.yml
@@ -71,7 +71,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/build-multiswebench-images.yml b/.github/workflows/build-multiswebench-images.yml
index 324fca352..7fd0b4004 100644
--- a/.github/workflows/build-multiswebench-images.yml
+++ b/.github/workflows/build-multiswebench-images.yml
@@ -115,7 +115,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
       
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # When ref is empty, actions/checkout uses the commit that triggered the workflow
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/build-programbench-images.yml b/.github/workflows/build-programbench-images.yml
index 9365def52..10fe22a2e 100644
--- a/.github/workflows/build-programbench-images.yml
+++ b/.github/workflows/build-programbench-images.yml
@@ -76,7 +76,7 @@ jobs:
           fi
 
       - name: Checkout benchmarks repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.ref.outputs.ref }}
diff --git a/.github/workflows/build-swebench-images.yml b/.github/workflows/build-swebench-images.yml
index 2fccde22e..24c7f26ed 100644
--- a/.github/workflows/build-swebench-images.yml
+++ b/.github/workflows/build-swebench-images.yml
@@ -133,7 +133,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/build-swebenchmultimodal-images.yml b/.github/workflows/build-swebenchmultimodal-images.yml
index 3c73c5255..a6fdebf1d 100644
--- a/.github/workflows/build-swebenchmultimodal-images.yml
+++ b/.github/workflows/build-swebenchmultimodal-images.yml
@@ -144,7 +144,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.checkout-ref.outputs.ref }}
@@ -316,7 +316,7 @@ jobs:
 
       - name: Comment on PR with build results
         if: github.event_name == 'pull_request_target'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/build-swebenchpro-images.yml b/.github/workflows/build-swebenchpro-images.yml
index 133dec95d..bc745df23 100644
--- a/.github/workflows/build-swebenchpro-images.yml
+++ b/.github/workflows/build-swebenchpro-images.yml
@@ -139,7 +139,7 @@ jobs:
             echo "ref=" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.checkout-ref.outputs.ref }}
@@ -185,7 +185,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -238,7 +238,7 @@ jobs:
 
       - name: Upload build logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: build-logs-${{ github.run_id }}
           path: build-logs.tar.gz
diff --git a/.github/workflows/build-swegym-images.yml b/.github/workflows/build-swegym-images.yml
index c574c6914..d9eeff422 100644
--- a/.github/workflows/build-swegym-images.yml
+++ b/.github/workflows/build-swegym-images.yml
@@ -109,7 +109,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
       
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # When ref is empty, actions/checkout uses the commit that triggered the workflow
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/build-swesmith-images.yml b/.github/workflows/build-swesmith-images.yml
index f4c783065..3285544fa 100644
--- a/.github/workflows/build-swesmith-images.yml
+++ b/.github/workflows/build-swesmith-images.yml
@@ -109,7 +109,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
       
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # When ref is empty, actions/checkout uses the commit that triggered the workflow
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/build-swtbench-images.yml b/.github/workflows/build-swtbench-images.yml
index 904dcfb35..3a7ab006b 100644
--- a/.github/workflows/build-swtbench-images.yml
+++ b/.github/workflows/build-swtbench-images.yml
@@ -139,7 +139,7 @@ jobs:
             echo "Using default ref (the commit that triggered this workflow)"
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: OpenHands/benchmarks
           ref: ${{ steps.checkout-ref.outputs.ref }}
diff --git a/.github/workflows/ghcr-retention.yml b/.github/workflows/ghcr-retention.yml
index bac4423bb..92bf79f22 100644
--- a/.github/workflows/ghcr-retention.yml
+++ b/.github/workflows/ghcr-retention.yml
@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 720  # 12h — first real run may delete tens of thousands of versions
     steps:
       - name: Delete old eval-agent-server versions
-        uses: snok/container-retention-policy@4f22ef80902ad409ed55a99dc5133cc1250a0d03  # v3.0.0
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53  # v3.1.0
         with:
           account: OpenHands
           token: ${{ secrets.GHCR_CLEANUP_PAT }}
diff --git a/.github/workflows/precommit.yml b/.github/workflows/precommit.yml
index 8073a71b7..30e4470cb 100644
--- a/.github/workflows/precommit.yml
+++ b/.github/workflows/precommit.yml
@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           submodules: recursive
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9d7ce7f18..70a656b41 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive