diff --git a/.github/workflows/auto-release.yaml b/.github/workflows/auto-release.yaml
index a3fa5fa3..b6d31820 100644
--- a/.github/workflows/auto-release.yaml
+++ b/.github/workflows/auto-release.yaml
@@ -28,7 +28,7 @@ jobs:
       next_version: ${{ steps.check.outputs.next_version }}
       latest_tag: ${{ steps.check.outputs.latest_tag }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -201,7 +201,7 @@ jobs:
       coverage_pct: ${{ steps.metrics.outputs.coverage_pct }}
       code_lines: ${{ steps.metrics.outputs.code_lines }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -257,7 +257,7 @@ jobs:
       HAS_RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN != '' }}
       HAS_GHCR_PACKAGE_ADMIN_TOKEN: ${{ secrets.GHCR_PACKAGE_ADMIN_TOKEN != '' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PR_TOKEN != '' && secrets.RELEASE_PR_TOKEN || github.token }}
@@ -430,7 +430,7 @@ jobs:
           echo "Ensured public visibility for ghcr.io/${OWNER_LC}/charts/loki-vl-proxy"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v3.0.1
         with:
           tag_name: ${{ steps.meta.outputs.tag }}
           name: ${{ steps.meta.outputs.tag }}
diff --git a/.github/workflows/changelog-pr.yaml b/.github/workflows/changelog-pr.yaml
index b66ae269..a59afac3 100644
--- a/.github/workflows/changelog-pr.yaml
+++ b/.github/workflows/changelog-pr.yaml
@@ -12,7 +12,7 @@ jobs:
   changelog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3ccc0b52..f147868e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -19,7 +19,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Verify dashboard and alerting assets are synced to chart
         run: ./scripts/ci/sync_observability_assets.sh --check
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -87,7 +87,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -188,7 +188,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -221,7 +221,7 @@ jobs:
       PROXY_URL_CATEGORIZED: http://127.0.0.1:13102
       SMOKE_QUERY: '{app="e2e-test"}'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -269,7 +269,7 @@ jobs:
   bench:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -597,7 +597,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -623,7 +623,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build Docker image
         run: docker build -t loki-vl-proxy:test .
@@ -653,7 +653,7 @@ jobs:
             pattern: '^(TestSetup_IngestLogs|TestQuerySemanticsMatrixManifest|TestQuerySemanticsOperationsInventory|TestQuerySemanticsMatrix|TestGrafanaClickout_.*|TestMissingOps_.*|TestRangeMetricCompatibility.*|TestLogQL_Exhaustive_.*|TestPipeline_.*|TestEdge_DropErrorInstantQueryReturnsAggregatedResult|TestEdge_DetectedFieldsAfterJsonDropPipelineIncludesJsonFields)$'
     name: e2e-compat (${{ matrix.group.name }})
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -730,7 +730,7 @@ jobs:
     env:
       PROXY_IMAGE: loki-vl-proxy:fleet-ci
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -787,7 +787,7 @@ jobs:
             command: --grep @explore-mt
     name: e2e-ui (${{ matrix.shard.name }})
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -868,7 +868,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -892,7 +892,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -914,7 +914,7 @@ jobs:
   helm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index ffa5c86b..905070d1 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -24,7 +24,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/compat-drilldown.yaml b/.github/workflows/compat-drilldown.yaml
index 95034a81..4a01c9eb 100644
--- a/.github/workflows/compat-drilldown.yaml
+++ b/.github/workflows/compat-drilldown.yaml
@@ -25,7 +25,7 @@ jobs:
       grafana_runtime_profiles: ${{ steps.matrix.outputs.grafana_runtime_profiles }}
       grafana_pr_runtime_profiles: ${{ steps.matrix.outputs.grafana_pr_runtime_profiles }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: matrix
         run: |
           {
@@ -44,7 +44,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:13.0.1
       PROXY_IMAGE: loki-vl-proxy:compat-drilldown
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -84,7 +84,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:${{ matrix.version }}
       PROXY_IMAGE: loki-vl-proxy:compat-drilldown
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -119,7 +119,7 @@ jobs:
       matrix:
         drilldown_version: ${{ fromJson(needs.drilldown-matrix-source.outputs.drilldown_versions) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Check Drilldown app contracts
         run: bash scripts/compat/check-drilldown-contracts.sh "${{ matrix.drilldown_version }}"
 
@@ -137,7 +137,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:${{ matrix.version }}
       PROXY_IMAGE: loki-vl-proxy:compat-drilldown
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
diff --git a/.github/workflows/compat-loki.yaml b/.github/workflows/compat-loki.yaml
index d6e86417..cbc459d3 100644
--- a/.github/workflows/compat-loki.yaml
+++ b/.github/workflows/compat-loki.yaml
@@ -23,7 +23,7 @@ jobs:
     outputs:
       loki_versions: ${{ steps.matrix.outputs.loki_versions }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: matrix
         run: echo "loki_versions=$(jq -c '.stack.loki.matrix_versions' test/e2e-compat/compatibility-matrix.json)" >> "$GITHUB_OUTPUT"
 
@@ -37,7 +37,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:12.4.2
       PROXY_IMAGE: loki-vl-proxy:compat-loki
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -107,7 +107,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:12.4.2
       PROXY_IMAGE: loki-vl-proxy:compat-loki
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
diff --git a/.github/workflows/compat-vl.yaml b/.github/workflows/compat-vl.yaml
index b982dcfd..8c2b7ff2 100644
--- a/.github/workflows/compat-vl.yaml
+++ b/.github/workflows/compat-vl.yaml
@@ -23,7 +23,7 @@ jobs:
     outputs:
       vl_versions: ${{ steps.matrix.outputs.vl_versions }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: matrix
         run: echo "vl_versions=$(jq -c '.stack.victorialogs.matrix_versions' test/e2e-compat/compatibility-matrix.json)" >> "$GITHUB_OUTPUT"
 
@@ -37,7 +37,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:12.4.2
       PROXY_IMAGE: loki-vl-proxy:compat-vl
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
@@ -76,7 +76,7 @@ jobs:
       GRAFANA_IMAGE: grafana/grafana:12.4.2
       PROXY_IMAGE: loki-vl-proxy:compat-vl
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version: "1.26.4"
diff --git a/.github/workflows/docs-site.yaml b/.github/workflows/docs-site.yaml
index 531316c4..15efdf6d 100644
--- a/.github/workflows/docs-site.yaml
+++ b/.github/workflows/docs-site.yaml
@@ -35,7 +35,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Node
         uses: actions/setup-node@v6
diff --git a/.github/workflows/e2e-pipeline.yml b/.github/workflows/e2e-pipeline.yml
index 46b93809..220ac489 100644
--- a/.github/workflows/e2e-pipeline.yml
+++ b/.github/workflows/e2e-pipeline.yml
@@ -21,7 +21,7 @@ jobs:
     env:
       PROXY_IMAGE: loki-vl-proxy:e2e-pipeline
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/ghcr-badges.yaml b/.github/workflows/ghcr-badges.yaml
index 12692033..480496b4 100644
--- a/.github/workflows/ghcr-badges.yaml
+++ b/.github/workflows/ghcr-badges.yaml
@@ -16,7 +16,7 @@ jobs:
   update-badges:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Fetch GHCR pull counts
         id: pulls
diff --git a/.github/workflows/loc-badges.yaml b/.github/workflows/loc-badges.yaml
index 6daf662c..6a88b54e 100644
--- a/.github/workflows/loc-badges.yaml
+++ b/.github/workflows/loc-badges.yaml
@@ -13,7 +13,7 @@ jobs:
   update-loc-badges:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Count LOC
         id: loc
diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
index 438ff83d..6597a78f 100644
--- a/.github/workflows/pr-labeler.yaml
+++ b/.github/workflows/pr-labeler.yaml
@@ -12,7 +12,7 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pr-quality-report.yaml b/.github/workflows/pr-quality-report.yaml
index c05d5abe..82e9a6f4 100644
--- a/.github/workflows/pr-quality-report.yaml
+++ b/.github/workflows/pr-quality-report.yaml
@@ -15,7 +15,7 @@ jobs:
     env:
       PROXY_IMAGE: loki-vl-proxy:pr-quality
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/release-pr-validation.yaml b/.github/workflows/release-pr-validation.yaml
index a0112e21..66647a05 100644
--- a/.github/workflows/release-pr-validation.yaml
+++ b/.github/workflows/release-pr-validation.yaml
@@ -10,7 +10,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f987fa10..9ccbdb02 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -22,7 +22,7 @@ jobs:
       HAS_RELEASE_PR_TOKEN: ${{ secrets.RELEASE_PR_TOKEN != '' }}
       HAS_GHCR_PACKAGE_ADMIN_TOKEN: ${{ secrets.GHCR_PACKAGE_ADMIN_TOKEN != '' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           ref: ${{ inputs.tag }}
@@ -189,7 +189,7 @@ jobs:
           echo "Ensured public visibility for ghcr.io/${OWNER_LC}/charts/loki-vl-proxy"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: ${{ steps.version.outputs.tag }}
diff --git a/.github/workflows/security-heavy.yaml b/.github/workflows/security-heavy.yaml
index ed164540..338b43a0 100644
--- a/.github/workflows/security-heavy.yaml
+++ b/.github/workflows/security-heavy.yaml
@@ -17,7 +17,7 @@ jobs:
     env:
       PROXY_IMAGE: loki-vl-proxy:security-heavy
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: docker/setup-buildx-action@v4
 
@@ -70,7 +70,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Semgrep scan
         run: |
@@ -106,7 +106,7 @@ jobs:
     name: Heavy / fuzz
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -126,7 +126,7 @@ jobs:
       PROXY_IMAGE: loki-vl-proxy:security-heavy
       PROXY_BASE_URL: http://127.0.0.1:13100
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/security-pr.yaml b/.github/workflows/security-pr.yaml
index 22176ce7..1570d36a 100644
--- a/.github/workflows/security-pr.yaml
+++ b/.github/workflows/security-pr.yaml
@@ -24,7 +24,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -152,7 +152,7 @@ jobs:
       PROXY_IMAGE: loki-vl-proxy:security-ci
       PROXY_BASE_URL: http://127.0.0.1:13100
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
diff --git a/.github/workflows/vl-ast-coverage.yml b/.github/workflows/vl-ast-coverage.yml
index 33ad2221..455f6259 100644
--- a/.github/workflows/vl-ast-coverage.yml
+++ b/.github/workflows/vl-ast-coverage.yml
@@ -19,7 +19,7 @@ jobs:
     name: Check VL upstream AST coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Run VL AST coverage check
         env: