diff --git a/.github/workflows/edge.yml b/.github/workflows/edge.yml
index 61f3b24f07..e065a9bfe8 100644
--- a/.github/workflows/edge.yml
+++ b/.github/workflows/edge.yml
@@ -34,7 +34,7 @@ jobs:
       matrix:
         node: [ "23" ]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - run: .ci/scripts/test.sh -b "nightly" "${{ matrix.node }}"
 
   # This should list all the Node.js major versions listed at
@@ -55,7 +55,7 @@ jobs:
           - "20"
           - "18"
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - run: .ci/scripts/test.sh -b "rc" "${{ matrix.node }}"
         env:
           VERSION: ${{ matrix.node }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ef5d84c91f..35895c60d1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
     env:
       DOCKER_IMAGE_NAME: docker.elastic.co/observability/apm-agent-nodejs
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -32,7 +32,7 @@ jobs:
       # Setup a Docker "buildx" builder container, used by "build-push-action"
       # below for multi-platform image builds. Notes on multi-platform images:
       # https://github.com/elastic/apm-agent-nodejs/issues/4038#issuecomment-2130406402
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@v4.1.0
 
       - name: Log in to the Elastic Container registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
diff --git a/.github/workflows/tav-command.yml b/.github/workflows/tav-command.yml
index 2ce75f047a..ddbb1d7216 100644
--- a/.github/workflows/tav-command.yml
+++ b/.github/workflows/tav-command.yml
@@ -41,7 +41,7 @@ jobs:
               return;
             }
 
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -141,7 +141,7 @@ jobs:
         module_and_node: ${{ fromJSON(needs.command-validation.outputs.permutations) }}
     steps:
 
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
diff --git a/.github/workflows/tav.yml b/.github/workflows/tav.yml
index 96d5243479..1d8cc454f6 100644
--- a/.github/workflows/tav.yml
+++ b/.github/workflows/tav.yml
@@ -27,7 +27,7 @@ jobs:
       permutations: ${{ steps.transform.outputs.permutations }}
     steps:
 
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - id: transform
         name: Load matrix from tav.json
@@ -70,7 +70,7 @@ jobs:
         # https://docs.github.com/en/actions/learn-github-actions/usage-limits-billing-and-administration
         module_and_node: ${{ fromJSON(needs.prepare-matrix.outputs.permutations) }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - run: .ci/scripts/test.sh -b "release" -t ${{ matrix.module_and_node }}
         env:
           ELASTIC_APM_CONTEXT_MANAGER: ''
diff --git a/.github/workflows/test-fips.yml b/.github/workflows/test-fips.yml
index 31b73a87d5..0aebb12e41 100644
--- a/.github/workflows/test-fips.yml
+++ b/.github/workflows/test-fips.yml
@@ -30,7 +30,7 @@ jobs:
       - run: |
           apk update
           apk add nodejs npm
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - name: Is Node.js running in FIPS mode?
         run: |
           node -e 'const isFips = require("node:crypto").getFips(); console.log("isFips:", isFips); assert(isFips)'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 77167c9551..f5b46370b7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -34,7 +34,7 @@ jobs:
   lint:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
       - uses: actions/setup-node@v6
         with:
           node-version: 18
@@ -160,7 +160,7 @@ jobs:
           - '14.17'
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v6.0.3
+    - uses: actions/checkout@v7.0.0
     - uses: actions/setup-node@v6
       with:
         node-version: ${{ matrix.node }}
@@ -173,7 +173,7 @@ jobs:
   test-windows:
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v6.0.3
+    - uses: actions/checkout@v7.0.0
     - uses: actions/setup-node@v6
       with:
         # What Node.js version to test on Windows is a balance between which
diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml
index 63bf70a5ed..b9d4760a1e 100644
--- a/.github/workflows/updatecli.yml
+++ b/.github/workflows/updatecli.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
 
       - name: Get token
         id: get_token