diff --git a/.github/workflows/check_for_crowdin_updates.yml b/.github/workflows/check_for_crowdin_updates.yml
index 0a7becd..319fe89 100644
--- a/.github/workflows/check_for_crowdin_updates.yml
+++ b/.github/workflows/check_for_crowdin_updates.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
@@ -49,7 +49,7 @@ jobs:
           echo "All inputs: ${{ toJSON(inputs) }}"
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.12
           cache: 'pip' # caching pip dependencies
@@ -69,7 +69,7 @@ jobs:
             --concept_id 36 \
             --skip-untranslated-strings
       - name: Upload download artefacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: session-download
           path: |
@@ -86,12 +86,12 @@ jobs:
     needs: [fetch_translations]
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.12
           cache: 'pip'
@@ -102,7 +102,7 @@ jobs:
           pip install -r ${{ github.workspace }}/scripts/crowdin/requirements.txt
 
       - name: Download raw translations
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: session-download
           path: "${{ github.workspace }}/raw_translations"
@@ -116,7 +116,7 @@ jobs:
             --validation-report "${{ github.workspace }}/validation_report.json"
 
       - name: Upload parsed translations
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: session-parsed
           path: |
@@ -132,7 +132,7 @@ jobs:
     needs: [parse_translations]
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
@@ -143,7 +143,7 @@ jobs:
         uses: ./scripts/actions/setup_shared
 
       - name: Download parsed translations
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: session-parsed
           path: "${{ github.workspace }}"
@@ -155,7 +155,7 @@ jobs:
             "${{ github.workspace }}/ios/Session/Meta/Translations" \
             "${{ github.workspace }}/ios/SessionUIKit/Style Guide/Constants.swift"
       - name: Upload iOS artefacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: session-ios
           path: |
@@ -171,7 +171,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
@@ -179,7 +179,7 @@ jobs:
         uses: ./scripts/actions/setup_shared
 
       - name: Download parsed translations
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: session-parsed
           path: "${{ github.workspace }}"
@@ -191,7 +191,7 @@ jobs:
             "${{ github.workspace }}/output/generated"
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: session-localization
           path: |
@@ -210,7 +210,7 @@ jobs:
 
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
@@ -221,19 +221,19 @@ jobs:
         uses: ./scripts/actions/setup_shared
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
         with:
           gradle-version: wrapper
           cache-read-only: false
 
       - name: Download parsed translations
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: session-parsed
           path: "${{ github.workspace }}"
@@ -246,7 +246,7 @@ jobs:
             "${{ github.workspace }}/android/app/src/main/res" \
             "${{ github.workspace }}/android/app/src/main/java/org/session/libsession/utilities/NonTranslatableStringConstants.kt"
       - name: Upload Android artefacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: session-android
           path: |
@@ -289,21 +289,21 @@ jobs:
     if: ${{ github.event_name == 'schedule' || inputs.UPDATE_PULL_REQUESTS == true }}
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
       - name: Checkout Android
         uses: ./scripts/actions/checkout_android
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: session-android
           # this has to be the first shared parent on the upload artefact task for Android
           path: "${{ github.workspace }}/android/app/src/main"
 
       - name: Create Android Pull Request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           path: 'android'
           token: ${{ secrets.CROWDIN_PR_TOKEN }}
@@ -322,7 +322,7 @@ jobs:
     if: ${{ github.event_name == 'schedule' || inputs.UPDATE_PULL_REQUESTS == true }}
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
@@ -331,14 +331,14 @@ jobs:
         with:
           token: ${{ secrets.CROWDIN_PR_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: session-localization
           # Download to /generated folder in localization module repo
           path: "${{ github.workspace }}/module/generated"
 
       - name: Push directly to ${{ env.PR_TARGET_BRANCH }}
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           repository: module
           commit_message: ${{ env.PR_TITLE }}
@@ -356,21 +356,21 @@ jobs:
     if: ${{ github.event_name == 'schedule' || inputs.UPDATE_PULL_REQUESTS == true }}
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
       - name: Checkout iOS
         uses: ./scripts/actions/checkout_ios
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: session-ios
           # this has to be the first shared parent on the upload artefact task for iOS
           path: "${{ github.workspace }}/ios"
 
       - name: Create iOS Pull Request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           path: "ios"
           token: ${{ secrets.CROWDIN_PR_TOKEN }}
diff --git a/.github/workflows/fetch-release-stats.yml b/.github/workflows/fetch-release-stats.yml
index 28c7b74..626f780 100644
--- a/.github/workflows/fetch-release-stats.yml
+++ b/.github/workflows/fetch-release-stats.yml
@@ -11,10 +11,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
 
diff --git a/.github/workflows/update_static_snode_list.yml b/.github/workflows/update_static_snode_list.yml
index 4c3458d..68712bf 100644
--- a/.github/workflows/update_static_snode_list.yml
+++ b/.github/workflows/update_static_snode_list.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout Repo Content
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           path: 'scripts'
           # don't provide a branch (ref) so it uses the default for that event
@@ -30,7 +30,7 @@ jobs:
             "https://raw.githubusercontent.com/session-foundation/session-desktop-dynamic-assets/main/service-nodes-cache.json" \
             -o ${{ github.workspace }}/ios/Session/Meta/service-nodes-cache.json
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           path: "ios"
           token: ${{ secrets.CROWDIN_PR_TOKEN }}
diff --git a/actions/checkout_android/action.yml b/actions/checkout_android/action.yml
index e9ae0f8..d0818a4 100644
--- a/actions/checkout_android/action.yml
+++ b/actions/checkout_android/action.yml
@@ -4,7 +4,7 @@ runs:
   using: 'composite'
   steps:
       - name: Checkout Android
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: 'session-foundation/session-android'
           path: 'android'
diff --git a/actions/checkout_ios/action.yml b/actions/checkout_ios/action.yml
index c0a67d2..459be1d 100644
--- a/actions/checkout_ios/action.yml
+++ b/actions/checkout_ios/action.yml
@@ -4,7 +4,7 @@ runs:
   using: 'composite'
   steps:
       - name: Checkout iOS
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: 'session-foundation/session-ios'
           path: 'ios'
diff --git a/actions/checkout_localization_module/action.yml b/actions/checkout_localization_module/action.yml
index 1cf4a90..cbd8773 100644
--- a/actions/checkout_localization_module/action.yml
+++ b/actions/checkout_localization_module/action.yml
@@ -9,7 +9,7 @@ runs:
   using: 'composite'
   steps:
       - name: Checkout Localization Module
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: 'session-foundation/session-localization'
           path: 'module'
diff --git a/actions/setup_shared/action.yml b/actions/setup_shared/action.yml
index 360b270..357bdbb 100644
--- a/actions/setup_shared/action.yml
+++ b/actions/setup_shared/action.yml
@@ -4,7 +4,7 @@ runs:
   using: 'composite'
   steps:
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.12
           cache: 'pip' # caching pip dependencies
@@ -13,7 +13,7 @@ runs:
         run: |
           pip install -r ${{ github.workspace }}/scripts/crowdin/requirements.txt
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: session-download
           path: "${{ github.workspace }}/raw_translations"