diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a547d2984..3c916b90f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,7 +39,7 @@ jobs:
       - name: checkout code
         uses: actions/checkout@v5.0.0
       - name: setup java
-        uses: actions/setup-java@v5.2.0
+        uses: actions/setup-java@v5.4.0
         with:
           distribution: 'temurin'
           java-version: ${{matrix.jdk}}
@@ -79,7 +79,7 @@ jobs:
           file: ${{ matrix.jdk }}/${{ matrix.schema.env }}-coverage.svg
           run_id: ${{ github.run_id }}
       - name: Publish Test Report
-        uses: mikepenz/action-junit-report@v6.4.1
+        uses: mikepenz/action-junit-report@v6.4.2
         if: always()
         with:
           annotate_only: true
@@ -95,7 +95,7 @@ jobs:
       - name: checkout code
         uses: actions/checkout@v5.0.0
       - name: setup java
-        uses: actions/setup-java@v5.2.0
+        uses: actions/setup-java@v5.4.0
         with:
           distribution: 'temurin'
           java-version: 11
@@ -104,7 +104,7 @@ jobs:
         id: thebuild
         run: ./gradlew clean :cwms-data-api:test --tests "cwms.cda.api.OpenApiDocTest" --info --init-script init.gradle
       - name: Publish Test Report
-        uses: mikepenz/action-junit-report@v6.4.1
+        uses: mikepenz/action-junit-report@v6.4.2
         if: always()
         with:
           annotate_only: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 991df0413..ca4001c67 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,11 +17,11 @@ jobs:
         uses: actions/checkout@v5.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.36.0
+        uses: github/codeql-action/init@v4.36.3
         with:
           languages: 'java'
       - name: setup java
-        uses: actions/setup-java@v5.2.0
+        uses: actions/setup-java@v5.4.0
         with:
           java-version: '11'
           java-package: jdk
@@ -34,4 +34,4 @@ jobs:
         id: build
         run: ./gradlew build --info --init-script init.gradle
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.36.0
\ No newline at end of file
+        uses: github/codeql-action/analyze@v4.36.3
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4d497d7ae..3a16b2eef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           ref: ${{inputs.branch}}
       - name: setup java
-        uses: actions/setup-java@v5.2.0
+        uses: actions/setup-java@v5.4.0
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -96,10 +96,10 @@ jobs:
           generate_release_notes: true
           token: ${{ secrets.token != null && secrets.token || secrets.GITHUB_TOKEN }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.1.0
+        uses: docker/setup-buildx-action@v4.2.0
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6.1.0
+        uses: docker/metadata-action@v6.2.0
         with:
           # this is triggered by the schedule so we want to actually use the checked out information
           # and not the context from the workflow itself.
@@ -115,20 +115,20 @@ jobs:
             type=schedule,pattern=${{inputs.branch}}-{{date 'YYYY.MM.DD-hhmmss'}}
       - name: Log in to the Container registry
         id: login-ghcr
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.token != null && secrets.token || secrets.GITHUB_TOKEN }}
       - name: Login to HEC Public Registry
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.4.0
         id: login-hec
         with:
           registry: ${{ secrets.registry != null && secrets.registry ||secrets.HEC_PUB_REGISTRY }}
           username: ${{ secrets.registry_user != null && secrets.registry_user || secrets.ALT_REG_USER }}
           password: ${{ secrets.registry_password != null && secrets.registry_password || secrets.ALT_REG_PASSWORD }}
       - name: Build and push
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@v7.3.0
         with:
           context: "."
           # This is not conditional on pull_request as we want access to these if we are manually running it.