diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b042dfce5..e2efb5af5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -35,7 +35,7 @@ jobs:
           pyflakes --version
         if: ${{ matrix.os == 'windows-latest' }}
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.go }}
       - run: go test -v -race -coverprofile coverage.txt -covermode=atomic ./...
@@ -51,9 +51,10 @@ jobs:
         run: |
           echo "::add-matcher::.github/actionlint-matcher.json"
           ./actionlint -color
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
         with:
           env_vars: OS
+          token: ${{ secrets.CODECOV_TOKEN }}
         env:
           OS: ${{ matrix.os }}
   wasm:
@@ -61,14 +62,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.21'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: "lts/*"
       - name: Cache node_modules
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ./playground/node_modules
           key: ${{ hashFiles('./playground/package.json') }}
@@ -83,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.21'
       - name: Check Go sources are formatted
@@ -107,7 +108,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Build image
         id: image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v5
         with:
           build-args: |
             GOLANG_VER=1.21
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index ea67ba73c..a52def733 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -29,13 +29,13 @@ jobs:
         language: ['go', 'javascript']
     steps:
       - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v2
+      - uses: github/codeql-action/init@v3
         with:
           config-file: ./.github/codeql/codeql-config.yaml
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@v2
+      - uses: github/codeql-action/autobuild@v3
         if: ${{ matrix.language != 'go' }}
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.21'
         if: ${{ matrix.language == 'go' }}
@@ -45,4 +45,4 @@ jobs:
           go build -v ./cmd/actionlint
           GOOS=js GOARCH=wasm go build -v -o ./playground/main.wasm ./playground
         if: ${{ matrix.language == 'go' }}
-      - uses: github/codeql-action/analyze@v2
+      - uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/generate.yaml b/.github/workflows/generate.yaml
index 70c79e495..5fc99c7ea 100644
--- a/.github/workflows/generate.yaml
+++ b/.github/workflows/generate.yaml
@@ -21,7 +21,7 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.21'
       - name: Check new release on GitHub
@@ -35,7 +35,7 @@ jobs:
             echo "pr=true" >> "$GITHUB_OUTPUT"
           fi
         id: diff
-      - uses: peter-evans/create-pull-request@v3
+      - uses: peter-evans/create-pull-request@v6
         with:
           branch: 'ci/${{ github.run_id }}'
           commit-message: 'update generated files by `go generate` on CI'
diff --git a/.github/workflows/matcher.yaml b/.github/workflows/matcher.yaml
index 09cf3cb63..ac8c3c49d 100644
--- a/.github/workflows/matcher.yaml
+++ b/.github/workflows/matcher.yaml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.21'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: "lts/*"
       - name: Update test data
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 75f803e42..606fa3eb8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,13 +14,13 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: '3.0'
+          ruby-version: '3.3'
       - run: gem install ronn
       - run: ronn ./man/actionlint.1.ronn
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.21'
-      - uses: goreleaser/goreleaser-action@v4
+      - uses: goreleaser/goreleaser-action@v5
         with:
           version: latest
           args: release --clean
@@ -63,17 +63,17 @@ jobs:
         run: |
           echo "name=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       - name: Login to DockerHub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: rhysd
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v5
         with:
           platforms: linux/amd64,linux/arm64
           build-args: |