diff --git a/.github/workflows/auto-review.yml b/.github/workflows/auto-review.yml
index cb370a06..64204f6b 100644
--- a/.github/workflows/auto-review.yml
+++ b/.github/workflows/auto-review.yml
@@ -14,12 +14,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.11'
+          python-version: '3.14'
 
       - name: Install dependencies
         run: |
@@ -28,7 +28,7 @@ jobs:
 
       - name: Generate Bootc Actions Token
         id: bootc_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/autovendor.yml b/.github/workflows/autovendor.yml
index 13eb231e..cfc7ec4e 100644
--- a/.github/workflows/autovendor.yml
+++ b/.github/workflows/autovendor.yml
@@ -12,13 +12,13 @@ jobs:
   vendor:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
       - name: Install vendor tool
         run: cargo install cargo-vendor-filterer
       - name: Run
         run: mkdir -p target && cd crates/cli && cargo vendor-filterer --format=tar.zstd --prefix=vendor/ ../../target/vendor.tar.zst
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: vendor.tar.zst
           path: target/vendor.tar.zst
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a6f8e5e0..74beee40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install deps
         run: ./ci/installdeps.sh
       - name: Mark git checkout as safe
@@ -54,7 +54,7 @@ jobs:
           sudo apt install -y crun/testing podman/testing skopeo/testing
       - name: Installdeps
         run: sudo apt update && sudo apt install just
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build and run container integration tests
         run: |
           sudo just build
@@ -71,13 +71,13 @@ jobs:
           sudo apt install -y crun/testing podman/testing skopeo/testing
       - name: Installdeps
         run: sudo apt update && sudo apt install just
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build with continuous repo enabled
         run: sudo just build --build-arg=continuous_repo=1
   cargo-deny:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: EmbarkStudios/cargo-deny-action@v2
       with:
         log-level: warn
@@ -95,7 +95,7 @@ jobs:
           sudo apt update
           sudo apt install -y crun/testing podman/testing skopeo/testing
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Free up disk space on runner
         run: sudo ./ci/clean-gha-runner.sh
       - name: Enable fsverity for /
@@ -150,7 +150,7 @@ jobs:
     env:
       MDBOOK_VERSION: 0.4.37
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install mdBook
         run: |
           tag=$(curl 'https://api.github.com/repos/rust-lang/mdbook/releases/latest' | jq -r '.tag_name')
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dd7f546f..8fc73e9b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -26,7 +26,7 @@ jobs:
     env:
       MDBOOK_VERSION: 0.4.37
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install mdBook
         run: |
           tag=$(curl 'https://api.github.com/repos/rust-lang/mdbook/releases/latest' | jq -r '.tag_name')
@@ -58,7 +58,7 @@ jobs:
       - name: Build with mdBook
         run: cd docs && mdbook-mermaid install && mdbook build
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v4
         with:
           path: ./docs/book/html
 
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 3f2fe1b6..b7b7aeef 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -22,7 +22,7 @@ jobs:
           sudo apt update
           sudo apt install -y crun/testing podman/testing just
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set architecture variable
         id: set_arch
@@ -33,7 +33,7 @@ jobs:
           sudo tests/build.sh ${{ matrix.test_os }}
 
       - name: Archive bootc disk image - disk.raw
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: PR-${{ github.event.number }}-${{ matrix.test_os }}-${{ env.ARCH }}-disk
           path: target/disk.raw
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set architecture variable
         id: set_arch
@@ -66,7 +66,7 @@ jobs:
         run: mkdir -p target
 
       - name: Download disk.raw
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: PR-${{ github.event.number }}-${{ matrix.test_os }}-${{ env.ARCH }}-disk
           path: target
@@ -85,7 +85,7 @@ jobs:
 
       - name: Archive TMT logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: tmt-log-PR-${{ github.event.number }}-${{ matrix.test_os }}-${{ env.ARCH }}-${{ matrix.tmt_plan }}
           path: /var/tmp/tmt
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index cc4a8781..0f6624fb 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -9,5 +9,5 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/labeler@v5
+      - uses: actions/checkout@v5
+      - uses: actions/labeler@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a16ce105..79363589 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/scheduled-release.yml b/.github/workflows/scheduled-release.yml
index c7f43f1c..b77f2dcf 100644
--- a/.github/workflows/scheduled-release.yml
+++ b/.github/workflows/scheduled-release.yml
@@ -29,7 +29,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/crates/ostree-ext/.github/workflows/rust.yml b/crates/ostree-ext/.github/workflows/rust.yml
index 91c971ea..028c44be 100644
--- a/crates/ostree-ext/.github/workflows/rust.yml
+++ b/crates/ostree-ext/.github/workflows/rust.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Code lints
         run: ./ci/lints.sh
       - name: Install deps
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Install deps
         run: ./ci/installdeps.sh
       - name: Cache Dependencies
@@ -57,7 +57,7 @@ jobs:
       - name: Build
         run: cargo build --release --features=internal-testing-api
       - name: Upload binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ostree-ext-cli
           path: target/release/ostree-ext-cli
@@ -67,7 +67,7 @@ jobs:
     container: quay.io/coreos-assembler/fcos-buildroot:testing-devel
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Install deps
         run: ./ci/installdeps.sh
       - name: Detect crate MSRV
@@ -91,8 +91,8 @@ jobs:
   cargo-deny:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: EmbarkStudios/cargo-deny-action@v1
+    - uses: actions/checkout@v5
+    - uses: EmbarkStudios/cargo-deny-action@v2
       with:
         log-level: warn
         command: check bans sources licenses
@@ -103,9 +103,9 @@ jobs:
     container: quay.io/fedora/fedora-coreos:testing-devel
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Download ostree-ext-cli
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v6.0.0
         with:
           name: ostree-ext-cli
       - name: Install
@@ -119,9 +119,9 @@ jobs:
     container: quay.io/fedora/fedora-coreos:testing-devel
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Download ostree-ext-cli
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v6.0.0
         with:
           name: ostree-ext-cli
       - name: Install
@@ -137,9 +137,9 @@ jobs:
       options: "--privileged --pid=host -v /var/tmp:/var/tmp -v /run/dbus:/run/dbus -v /run/systemd:/run/systemd -v /:/run/host"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Download
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v6.0.0
         with:
           name: ostree-ext-cli
       - name: Install
@@ -152,14 +152,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
       - name: Checkout coreos-layering-examples
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           repository: coreos/coreos-layering-examples
           path: coreos-layering-examples
       - name: Download
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v6.0.0
         with:
           name: ostree-ext-cli
       - name: Integration tests