diff --git a/.github/workflows/build-envoy-image-ci.yaml b/.github/workflows/build-envoy-image-ci.yaml
index 2944c1355..0bada6ef2 100644
--- a/.github/workflows/build-envoy-image-ci.yaml
+++ b/.github/workflows/build-envoy-image-ci.yaml
@@ -37,7 +37,7 @@ jobs:
         restore-keys: docker-cache-main
 
     - name: Login to quay.io
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: quay.io
         username: ${{ secrets.QUAY_ENVOY_USERNAME_DEV }}
@@ -67,7 +67,7 @@ jobs:
         fi
 
     - name: PR Multi-arch build & push of Builder image (dev)
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false'
       id: docker_build_builder_ci
       with:
@@ -86,7 +86,7 @@ jobs:
         echo "quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}@${{ steps.docker_build_builder_ci.outputs.digest }}"
 
     - name: PR Multi-arch build & push of cilium-envoy
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       id: docker_build_ci
       with:
         provenance: false
diff --git a/.github/workflows/build-envoy-images-release-base.yaml b/.github/workflows/build-envoy-images-release-base.yaml
index 08c5a793e..6248573ee 100644
--- a/.github/workflows/build-envoy-images-release-base.yaml
+++ b/.github/workflows/build-envoy-images-release-base.yaml
@@ -40,7 +40,7 @@ jobs:
       uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
     - name: Login to quay.io
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: quay.io
         username: ${{ secrets.QUAY_ENVOY_USERNAME }}
@@ -75,7 +75,7 @@ jobs:
         images: cilium-envoy-builder
 
     - name: Run integration tests on amd64 to update docker cache
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       id: docker_tests_ci_cache_update
       with:
         provenance: false
@@ -104,7 +104,7 @@ jobs:
       uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
     - name: Login to quay.io
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: quay.io
         username: ${{ secrets.QUAY_ENVOY_USERNAME }}
@@ -131,7 +131,7 @@ jobs:
         fi
 
     - name: Multi-arch build & push of Builder image
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false'
       id: docker_build_builder
       with:
@@ -144,7 +144,7 @@ jobs:
           quay.io/${{ github.repository_owner }}/cilium-envoy-builder:${{ env.BUILDER_DOCKER_HASH }}
           quay.io/${{ github.repository_owner }}/cilium-envoy-builder:${{ github.ref_name }}
     - name: Multi-arch build & push of build artifact archive
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       with:
         context: .
         file: ./Dockerfile
@@ -170,7 +170,7 @@ jobs:
         docker buildx prune -f
 
     - name: Multi-arch build & push ${{ github.ref_name }} latest
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       id: docker_build_cd
       with:
         provenance: false
diff --git a/.github/workflows/ci-check-format.yaml b/.github/workflows/ci-check-format.yaml
index 49af2f359..16f80c393 100644
--- a/.github/workflows/ci-check-format.yaml
+++ b/.github/workflows/ci-check-format.yaml
@@ -36,7 +36,7 @@ jobs:
         images: cilium-envoy-builder-dev
 
     - name: Check format
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       id: docker_format_ciak
       with:
         target: format
@@ -54,7 +54,7 @@ jobs:
 
     - name: Upload Format results
       if: failure()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: check-format-results
         path: check-format-results/format-output.txt
@@ -87,7 +87,7 @@ jobs:
         images: cilium-envoy-builder-dev
 
     - name: Run clang-tidy
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       # skip if nothing changed
       if: ${{ env.TIDY_SOURCES != '' }}
       id: docker_clang_tidy
@@ -111,7 +111,7 @@ jobs:
 
     - name: Upload clang-tidy results
       if: failure()
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: clang-tidy-results
         path: clang-tidy-results/*.txt
diff --git a/.github/workflows/ci-tests.yaml b/.github/workflows/ci-tests.yaml
index 7747525a7..9a72e13cd 100644
--- a/.github/workflows/ci-tests.yaml
+++ b/.github/workflows/ci-tests.yaml
@@ -21,7 +21,7 @@ jobs:
       uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
         # renovate: datasource=golang-version depName=go
-        go-version: 1.25.8
+        go-version: 1.25.9
     - name: Checkout code
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
@@ -69,7 +69,7 @@ jobs:
         images: cilium-envoy-builder-dev
 
     - name: Run integration tests on amd64
-      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       id: docker_tests_ci
       with:
         provenance: false
diff --git a/.github/workflows/cilium-gateway-api.yaml b/.github/workflows/cilium-gateway-api.yaml
index 843f1fda8..3bfa2893a 100644
--- a/.github/workflows/cilium-gateway-api.yaml
+++ b/.github/workflows/cilium-gateway-api.yaml
@@ -194,7 +194,7 @@ jobs:
 
       - name: Upload Cilium system dump
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cilium-gateway-api-test-sysdumps
           path: cilium-sysdump-*.zip
diff --git a/.github/workflows/cilium-integration-tests.yaml b/.github/workflows/cilium-integration-tests.yaml
index 39933ad37..f89c98767 100644
--- a/.github/workflows/cilium-integration-tests.yaml
+++ b/.github/workflows/cilium-integration-tests.yaml
@@ -99,7 +99,7 @@ jobs:
         uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           # renovate: datasource=golang-version depName=go
-          go-version: 1.25.8
+          go-version: 1.25.9
 
       - name: Redirect proxy module
         shell: bash
@@ -177,7 +177,7 @@ jobs:
 
       - name: Upload Cilium system dump
         if: failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cilium-integration-test-sysdumps
           path: cilium-sysdump-*.zip