diff --git a/.github/workflows/ci-self-test.yml b/.github/workflows/ci-self-test.yml
index 50bb216..dc8d5ef 100644
--- a/.github/workflows/ci-self-test.yml
+++ b/.github/workflows/ci-self-test.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install yq
         run: |
@@ -80,7 +80,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install yq
         run: |
@@ -117,7 +117,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install all tools
         uses: ./actions/setup-tooling
@@ -153,7 +153,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Post test comment
         uses: ./actions/pr-comment
@@ -173,7 +173,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create synthetic tfplan.json
         run: |
@@ -221,7 +221,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check examples reference @main or a version tag
         run: |
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index c0d0f03..fb23acf 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Assume AWS role (ECR only)
         if: inputs.registry == 'ecr'
diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml
index 554e9fe..5693f5a 100644
--- a/.github/workflows/docs-check.yml
+++ b/.github/workflows/docs-check.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Verify each action has a README
         run: |
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Verify all actions are documented in docs/actions.md
         run: |
@@ -84,7 +84,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install yq
         run: |
diff --git a/.github/workflows/helm-deploy.yml b/.github/workflows/helm-deploy.yml
index 954a4d2..a8a37bf 100644
--- a/.github/workflows/helm-deploy.yml
+++ b/.github/workflows/helm-deploy.yml
@@ -91,7 +91,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Helm
         uses: kernelpanic09/github-actions-platform/actions/setup-tooling@main
@@ -139,7 +139,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Helm
         uses: kernelpanic09/github-actions-platform/actions/setup-tooling@main
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index d3949eb..98c0508 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -60,7 +60,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Assume AWS role
         uses: kernelpanic09/github-actions-platform/actions/aws-oidc-assume@main
@@ -74,7 +74,7 @@ jobs:
           terraform_version: ${{ inputs.terraform_version }}
 
       - name: Cache .terraform directory
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ${{ inputs.working_directory }}/.terraform
           # Cache key includes the lockfile so a provider version bump busts the cache
@@ -158,7 +158,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Assume AWS role
         uses: kernelpanic09/github-actions-platform/actions/aws-oidc-assume@main
@@ -172,7 +172,7 @@ jobs:
           terraform_version: ${{ inputs.terraform_version }}
 
       - name: Restore .terraform cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ${{ inputs.working_directory }}/.terraform
           key: terraform-${{ inputs.working_directory }}-${{ hashFiles(format('{0}/.terraform.lock.hcl', inputs.working_directory)) }}
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index da8afe4..a6fc073 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Trivy
         uses: kernelpanic09/github-actions-platform/actions/setup-tooling@main