diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 73e40244..13329fbb 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -97,12 +97,12 @@ jobs:
             docker-build-${{ hashFiles('cronjobs/Dockerfile') }}-
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           install: true
 
       - name: Build cronjobs container
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           cache-from: type=local,src=${{ env.DOCKER_CACHE}}/cronjobs
           cache-to: type=local,dest=${{ env.DOCKER_CACHE}}/cronjobs,mode=max
@@ -137,12 +137,12 @@ jobs:
             docker-build-
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           install: true
 
       - name: Build web container
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           cache-from: type=local,src=${{ env.DOCKER_CACHE}}/web
           cache-to: type=local,dest=${{ env.DOCKER_CACHE}}/web,mode=max
@@ -151,7 +151,7 @@ jobs:
           tags: remotesettings/local  # Like with docker compose build web
 
       - name: Build test container
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           cache-from: type=local,src=${{ env.DOCKER_CACHE}}/tests
           cache-to: type=local,dest=${{ env.DOCKER_CACHE}}/tests,mode=max
diff --git a/.github/workflows/ingestion-job-publish.yaml b/.github/workflows/ingestion-job-publish.yaml
index a7b6655c..cb9ef181 100644
--- a/.github/workflows/ingestion-job-publish.yaml
+++ b/.github/workflows/ingestion-job-publish.yaml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GAR_REPOSITORY }}/${{ env.GAR_IMAGE_NAME }}
@@ -86,17 +86,17 @@ jobs:
           workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
 
       - name: Login to GAR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.gcp_auth.outputs.access_token }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ inputs.publish }}
diff --git a/.github/workflows/publish-ent.yaml b/.github/workflows/publish-ent.yaml
index 570bfbb7..df8db05f 100644
--- a/.github/workflows/publish-ent.yaml
+++ b/.github/workflows/publish-ent.yaml
@@ -41,7 +41,7 @@ jobs:
             cat ./git-reader/version.json
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.ENT_GCP_PROJECT_ID }}/${{ env.ENT_GAR_REPOSITORY }}/${{ env.GAR_IMAGE_NAME }}
@@ -50,7 +50,7 @@ jobs:
             type=sha,format=long,enable=${{ github.event_name == 'push' }}
             type=semver,pattern={{raw}},enable=${{ github.event_name == 'release' }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Authenticate on GCP
         id: gcp_auth
         uses: google-github-actions/auth@v3
@@ -60,13 +60,13 @@ jobs:
           workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Login to GAR
         if: ${{ github.event_name != 'pull_request' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.gcp_auth.outputs.access_token }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: git-reader/
           push: ${{ github.event_name != 'pull_request' }}
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 4b7f5ca6..aeb50728 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -34,9 +34,9 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Enable multiplatform builds
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           buildkitd-flags: "--debug" # Enable detailed logging
       - name: Set tag version
@@ -53,7 +53,7 @@ jobs:
             cat ./version.json
       - name: Extract metadata for Google Artifact Registry
         id: metagar
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           flavor:
             # don't automatically tag with `latest`; we do this conditionally in the `tags` section
@@ -66,7 +66,7 @@ jobs:
             type=semver,pattern={{raw}},enable=${{ github.event_name == 'release' }}
       - name: Docker Metadata for Docker Hub
         id: metahub
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           flavor:
             # don't automatically tag with `latest`; we do this conditionally in the `tags` section
@@ -77,7 +77,7 @@ jobs:
             type=semver,pattern={{raw}},enable=${{ github.event_name == 'release' }}
             type=raw,value=latest,enable=${{ github.event_name == 'push' }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Authenticate on GCP
         id: gcp_auth
         uses: google-github-actions/auth@v3
@@ -87,20 +87,20 @@ jobs:
           workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Login to GAR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.gcp_auth.outputs.access_token }}
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and push to GAR
         if: ${{ github.event_name == 'push' }}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: RemoteSettings.Dockerfile
@@ -114,7 +114,7 @@ jobs:
           cache-to: type=gha,mode=max # Save cache to GitHub Actions
       - name: Build and push release to GAR
         if: ${{ github.event_name == 'release' }}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Release.Dockerfile
@@ -160,14 +160,14 @@ jobs:
         run: echo "LATEST_TAG=$(git describe --tags --abbrev=4)" >> "$GITHUB_ENV"
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GAR_REPOSITORY }}/${{ env.GAR_IMAGE_NAME }}
           tags: |
             type=raw,value=latest
             type=raw,value=${{ env.LATEST_TAG }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Authenticate on GCP
         id: gcp_auth
         uses: google-github-actions/auth@v3
@@ -177,13 +177,13 @@ jobs:
           workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Login to GAR
         if: github.event_name == 'push'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.gcp_auth.outputs.access_token }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: cronjobs/
           push: ${{ github.event_name == 'push' }}
@@ -215,14 +215,14 @@ jobs:
         run: echo "LATEST_TAG=$(git describe --tags --abbrev=4)" >> "$GITHUB_ENV"
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GAR_REPOSITORY }}/${{ env.GAR_IMAGE_NAME }}
           tags: |
             type=raw,value=${{ env.LATEST_TAG }}
             type=raw,value=latest
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Authenticate on GCP
         id: gcp_auth
         uses: google-github-actions/auth@v3
@@ -232,13 +232,13 @@ jobs:
           workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Login to GAR
         if: ${{ github.event_name == 'push' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.gcp_auth.outputs.access_token }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: browser-tests/
           push: ${{ github.event_name == 'push' }}
@@ -280,7 +280,7 @@ jobs:
             cat ./git-reader/version.json
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GAR_REPOSITORY }}/${{ env.GAR_IMAGE_NAME }}
@@ -289,7 +289,7 @@ jobs:
             type=sha,format=long,enable=${{ github.event_name == 'push' }}
             type=semver,pattern={{raw}},enable=${{ github.event_name == 'release' }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Authenticate on GCP
         id: gcp_auth
         uses: google-github-actions/auth@v3
@@ -299,13 +299,13 @@ jobs:
           workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
       - name: Login to GAR
         if: ${{ github.event_name != 'pull_request' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.gcp_auth.outputs.access_token }}
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: git-reader/
           push: ${{ github.event_name != 'pull_request' }}