diff --git a/.github/workflows/build_client.yaml b/.github/workflows/build_client.yaml
index caa7fa0c70c..be989873ee2 100644
--- a/.github/workflows/build_client.yaml
+++ b/.github/workflows/build_client.yaml
@@ -31,7 +31,7 @@ jobs:
         run: echo "commit=$(git rev-parse HEAD 2>/dev/null)" >> $GITHUB_OUTPUT
         working-directory: 'galaxy root'
       - name: cache client build
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         id: cache
         with:
           key: galaxy-static-${{ steps.client-commit.outputs.commit }}
diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml
index a8c204a3c7f..91f6b6ca5fd 100644
--- a/.github/workflows/build_container_image.yaml
+++ b/.github/workflows/build_container_image.yaml
@@ -35,7 +35,7 @@ jobs:
         shell: bash
       - name: Extract metadata for container image
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v6.1.0
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -47,19 +47,19 @@ jobs:
             echo "builddate=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"  >> $GITHUB_OUTPUT
       
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
         with:
           platforms: linux/amd64
 
       - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push container image to ghcr
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.2.0
         with:
           build-args: |
               GIT_COMMIT=${{ steps.buildargs.outputs.gitcommit }}
@@ -83,7 +83,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@v6.3.0
         with:
           python-version: '3.14'
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
@@ -112,20 +112,20 @@ jobs:
           echo "gitcommit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "builddate=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
       - name: Login to quay.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: Build and push galaxy-min image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.2.0
         with:
           context: .
           file: .k8s_ci.Dockerfile
@@ -141,7 +141,7 @@ jobs:
         run: |  # zizmor: ignore[template-injection]
           echo "FROM galaxy/galaxy-min:${{ steps.branch.outputs.name }}" > /tmp/Dockerfile.auto
       - name: Build and push auto-expiring per-commit image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.2.0
         with:
           file: /tmp/Dockerfile.auto
           push: true
diff --git a/.github/workflows/first_startup.yaml b/.github/workflows/first_startup.yaml
index 2cc643f9532..683dca4f5b5 100644
--- a/.github/workflows/first_startup.yaml
+++ b/.github/workflows/first_startup.yaml
@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Restore client cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/integration_selenium.yaml b/.github/workflows/integration_selenium.yaml
index 0edde54a4dd..fed467baa14 100644
--- a/.github/workflows/integration_selenium.yaml
+++ b/.github/workflows/integration_selenium.yaml
@@ -64,7 +64,7 @@ jobs:
       - name: Install Python
         run: uv python install
       - name: Restore client cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/osx_startup.yaml b/.github/workflows/osx_startup.yaml
index 023c81d5a81..d3260f42e1d 100644
--- a/.github/workflows/osx_startup.yaml
+++ b/.github/workflows/osx_startup.yaml
@@ -39,7 +39,7 @@ jobs:
           miniforge-version: latest
           activate-environment: ''
       - name: Restore client cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/playwright.yaml b/.github/workflows/playwright.yaml
index 8aef620b084..951cf81081f 100644
--- a/.github/workflows/playwright.yaml
+++ b/.github/workflows/playwright.yaml
@@ -65,7 +65,7 @@ jobs:
       - name: Install Python
         run: uv python install
       - name: Restore client cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/selenium.yaml b/.github/workflows/selenium.yaml
index 933612bbcb6..4b04a1b276c 100644
--- a/.github/workflows/selenium.yaml
+++ b/.github/workflows/selenium.yaml
@@ -64,7 +64,7 @@ jobs:
       - name: Install Python
         run: uv python install
       - name: Restore client cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/tool_form_harness.yaml b/.github/workflows/tool_form_harness.yaml
index 0ca95d89dea..8e8fbab6600 100644
--- a/.github/workflows/tool_form_harness.yaml
+++ b/.github/workflows/tool_form_harness.yaml
@@ -83,7 +83,7 @@ jobs:
           playwright install chromium --with-deps
         working-directory: 'galaxy root'
       - name: Restore client cache
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@v6.1.0
         with:
           fail-on-cache-miss: true
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 072b146ff78..815996c3c50 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -25,4 +25,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7