diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 543fcd06..4c1904a4 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -19,8 +19,8 @@ jobs:
       codechange: "${{ steps.filter.outputs.codechange }}"
       graphchange: "${{ steps.graph-filter.outputs.graphchange }}"
     steps:
-      - uses: "actions/checkout@v2"
-      - uses: "dorny/paths-filter@v2"
+      - uses: "actions/checkout@v4"
+      - uses: "dorny/paths-filter@v3"
         id: "filter"
         with:
           filters: |
@@ -33,7 +33,7 @@ jobs:
               - "pkg/**"
               - "e2e/**"
               - "internal/**"
-      - uses: "dorny/paths-filter@v2"
+      - uses: "dorny/paths-filter@v3"
         id: "graph-filter"
         with:
           filters: |
@@ -46,7 +46,7 @@ jobs:
     name: "Build Binary"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
       - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -59,7 +59,7 @@ jobs:
     name: "Build Container Image"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
       - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -77,16 +77,16 @@ jobs:
     name: "Unit Tests"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
         with:
           submodules: true
       - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-      - uses: "docker/setup-qemu-action@v2"
-      - uses: "docker/setup-buildx-action@v2"
+      - uses: "docker/setup-qemu-action@v3"
+      - uses: "docker/setup-buildx-action@v3"
       - name: "Run Unit Tests"
-        uses: "magefile/mage-action@v2"
+        uses: "magefile/mage-action@v3"
         with:
           version: "latest"
           args: "test:unit"
@@ -98,7 +98,7 @@ jobs:
     name: "E2E Tests"
     runs-on: "ubuntu-latest-8-cores"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
         if: |
           needs.paths-filter.outputs.graphchange == 'true'
         with:
@@ -106,7 +106,7 @@ jobs:
           token: "${{ secrets.AUTHZED_BOT_PAT }}"
           repository: "${{ github.event.pull_request.head.repo.full_name }}"
           ref: "${{ github.event.pull_request.head.ref }}"
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
         if: |
           needs.paths-filter.outputs.graphchange == 'false'
         with:
@@ -114,17 +114,17 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-      - uses: "docker/setup-qemu-action@v2"
-      - uses: "docker/setup-buildx-action@v2"
+      - uses: "docker/setup-qemu-action@v3"
+      - uses: "docker/setup-buildx-action@v3"
       - name: "Run E2E Tests"
-        uses: "magefile/mage-action@v2"
+        uses: "magefile/mage-action@v3"
         with:
           version: "latest"
           args: "test:e2e"
       - name: "Check if validated update graph has changed"
         if: |
           needs.paths-filter.outputs.graphchange == 'true'
-        uses: "tj-actions/verify-changed-files@v13"
+        uses: "tj-actions/verify-changed-files@v19"
         id: "verify-changed-graph"
         with:
           files: |
@@ -139,7 +139,7 @@ jobs:
           default_author: "github_actor"
           message: "update validated graph after successful tests"
           pathspec_error_handling: "exitImmediately"
-      - uses: "actions/upload-artifact@v2"
+      - uses: "actions/upload-artifact@v4"
         if: "always()"
         # this upload step is really flaky, don't fail the job if it fails
         continue-on-error: true
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index bbfdf371..036c5797 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -17,7 +17,7 @@ jobs:
     name: "Lint Go"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
       - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -27,7 +27,7 @@ jobs:
         working-directory: "magefiles"
         run: "go run mvdan.cc/gofumpt -w ."
       - name: "Codegen"
-        uses: "magefile/mage-action@v2"
+        uses: "magefile/mage-action@v3"
         with:
           version: "latest"
           args: "generate"
@@ -52,7 +52,7 @@ jobs:
     name: "Lint YAML & Markdown"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
       - uses: "authzed/actions/yaml-lint@main"
       - uses: "stefanprodan/kube-tools@v1"
         with:
@@ -77,5 +77,5 @@ jobs:
       matrix:
         language: ["go"]
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
       - uses: "authzed/actions/codeql@main"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 71bc1dc8..40735ddd 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,7 +15,7 @@ jobs:
     env:
       KUSTOMIZER_ARTIFACT: "oci://ghcr.io/${{github.repository_owner}}/${{github.event.repository.name}}-manifests"
     steps:
-      - uses: "actions/checkout@v3"
+      - uses: "actions/checkout@v4"
         with:
           fetch-depth: 0
       - uses: "authzed/actions/setup-go@main"
@@ -26,8 +26,8 @@ jobs:
           quayio_token: "${{ secrets.QUAYIO_PASSWORD }}"
           github_token: "${{ secrets.GITHUB_TOKEN }}"
           dockerhub_token: "${{ secrets.DOCKERHUB_ACCESS_TOKEN }}"
-      - uses: "docker/setup-qemu-action@v1"
-      - uses: "docker/setup-buildx-action@v1"
+      - uses: "docker/setup-qemu-action@v3"
+      - uses: "docker/setup-buildx-action@v3"
       # the release directory is gitignored, which keeps goreleaser from
       # complaining about a dirty tree
       - name: "Copy manifests to release directory"
@@ -44,7 +44,7 @@ jobs:
         with:
           kustomize_build_dir: "release/config"
           kustomize_output_file: "release/bundle.yaml"
-      - uses: "goreleaser/goreleaser-action@v2"
+      - uses: "goreleaser/goreleaser-action@v5"
         with:
           distribution: "goreleaser-pro"
           version: "latest"