diff --git a/.github/workflows/auto-release.yaml b/.github/workflows/auto-release.yaml
index b6d31820..3d4fbaec 100644
--- a/.github/workflows/auto-release.yaml
+++ b/.github/workflows/auto-release.yaml
@@ -211,7 +211,7 @@ jobs:
           cache: true
 
       - name: Install Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@v5.0.1
 
       - name: Verify unreleased changelog section exists
         run: |
@@ -268,7 +268,7 @@ jobs:
           cache: true
 
       - name: Install Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@v5.0.1
 
       - name: Extract release metadata
         id: meta
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f147868e..048a7e22 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -800,7 +800,7 @@ jobs:
           cache: npm
           cache-dependency-path: test/e2e-ui/package-lock.json
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-ms-playwright-${{ hashFiles('test/e2e-ui/package-lock.json') }}
@@ -922,7 +922,7 @@ jobs:
           cache: true
 
       - name: Install Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@v5.0.1
 
       - name: Helm lint
         run: helm lint charts/loki-vl-proxy/
diff --git a/.github/workflows/pr-quality-report.yaml b/.github/workflows/pr-quality-report.yaml
index 82e9a6f4..69597c48 100644
--- a/.github/workflows/pr-quality-report.yaml
+++ b/.github/workflows/pr-quality-report.yaml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Restore cached base quality snapshot
         id: base-quality-cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .cache/pr-quality/base-quality.json
           key: ${{ runner.os }}-pr-quality-base-${{ github.event.pull_request.base.sha }}-perf-${{ steps.perf-scope.outputs.run_perf }}-schema-v3
diff --git a/.github/workflows/release-pr-validation.yaml b/.github/workflows/release-pr-validation.yaml
index 66647a05..a43931de 100644
--- a/.github/workflows/release-pr-validation.yaml
+++ b/.github/workflows/release-pr-validation.yaml
@@ -69,7 +69,7 @@ jobs:
           grep -q "\"service.version\": \"${VERSION}\"" docs/observability.md
 
       - name: Helm lint
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@v5.0.1
 
       - name: Run Helm lint
         run: helm lint charts/loki-vl-proxy/
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 9ccbdb02..8dd89f9e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -34,7 +34,7 @@ jobs:
           cache: true
 
       - name: Install Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
       - name: Extract version
         id: version