diff --git a/.github/workflows/build-swebenchmultimodal-images.yml b/.github/workflows/build-swebenchmultimodal-images.yml
index 3c73c5255..482d527d0 100644
--- a/.github/workflows/build-swebenchmultimodal-images.yml
+++ b/.github/workflows/build-swebenchmultimodal-images.yml
@@ -316,7 +316,7 @@ jobs:
 
       - name: Comment on PR with build results
         if: github.event_name == 'pull_request_target'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/build-swebenchpro-images.yml b/.github/workflows/build-swebenchpro-images.yml
index 133dec95d..16e6487fa 100644
--- a/.github/workflows/build-swebenchpro-images.yml
+++ b/.github/workflows/build-swebenchpro-images.yml
@@ -185,7 +185,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -238,7 +238,7 @@ jobs:
 
       - name: Upload build logs
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: build-logs-${{ github.run_id }}
           path: build-logs.tar.gz
diff --git a/.github/workflows/ghcr-retention.yml b/.github/workflows/ghcr-retention.yml
index bac4423bb..92bf79f22 100644
--- a/.github/workflows/ghcr-retention.yml
+++ b/.github/workflows/ghcr-retention.yml
@@ -38,7 +38,7 @@ jobs:
     timeout-minutes: 720  # 12h — first real run may delete tens of thousands of versions
     steps:
       - name: Delete old eval-agent-server versions
-        uses: snok/container-retention-policy@4f22ef80902ad409ed55a99dc5133cc1250a0d03  # v3.0.0
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53  # v3.1.0
         with:
           account: OpenHands
           token: ${{ secrets.GHCR_CLEANUP_PAT }}