diff --git a/.github/workflows/ci-bazel.yml b/.github/workflows/ci-bazel.yml
index e49cd2ac7..b0279bb29 100644
--- a/.github/workflows/ci-bazel.yml
+++ b/.github/workflows/ci-bazel.yml
@@ -14,8 +14,8 @@ jobs:
     env:
       BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4.1.4
-      - uses: bazel-contrib/setup-bazel@0.8.2
+      - uses: actions/checkout@v4.1.6
+      - uses: bazel-contrib/setup-bazel@0.8.4
         with:
           bazelisk-version: '1.x'
       - run: .github/bazel.sh
diff --git a/.github/workflows/ci-cmake.yml b/.github/workflows/ci-cmake.yml
index c4f21ac40..113c1eafd 100644
--- a/.github/workflows/ci-cmake.yml
+++ b/.github/workflows/ci-cmake.yml
@@ -12,7 +12,7 @@ jobs:
       matrix:
         build_shared_libs: [OFF, ON]
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - name: Install Abseil, GoogleTest and Benchmark
         run: |
           vcpkg update
@@ -29,7 +29,7 @@ jobs:
       matrix:
         build_shared_libs: [OFF, ON]
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - name: Install Abseil, GoogleTest and Benchmark
         run: |
           brew update
@@ -44,7 +44,7 @@ jobs:
       matrix:
         build_shared_libs: [OFF, ON]
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - name: Install Abseil, GoogleTest and Benchmark
         run: |
           vcpkg update
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b367ca242..9b5cb2ca6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
       # (The other two flags are the default provided for CXXFLAGS in Makefile.)
       CXXFLAGS: -O3 -g -std=c++${{ matrix.ver }}
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - name: Install Abseil, GoogleTest and Benchmark
         run: |
           brew update
@@ -40,7 +40,7 @@ jobs:
       CXX: clang++-${{ matrix.ver }}
       PKG_CONFIG_PATH: /usr/local/share/vcpkg/installed/x64-linux/lib/pkgconfig
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - name: Install Clang ${{ matrix.ver }}
         run: |
           # Avoid `Conflicts: python3-lldb-x.y` between packages.
@@ -68,7 +68,7 @@ jobs:
       CXX: g++-${{ matrix.ver }}
       PKG_CONFIG_PATH: /usr/local/share/vcpkg/installed/x64-linux/lib/pkgconfig
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - name: Install Abseil, GoogleTest and Benchmark
         run: |
           vcpkg update
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index af2c45ddb..297e897af 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -17,8 +17,8 @@ jobs:
       # Bazel fails if the username is unknown.
       USER: runner
     steps:
-      - uses: actions/checkout@v4.1.4
-      - uses: bazel-contrib/setup-bazel@0.8.2
+      - uses: actions/checkout@v4.1.6
+      - uses: bazel-contrib/setup-bazel@0.8.4
         with:
           bazelisk-version: '1.x'
       - run: app/build.sh
@@ -37,5 +37,5 @@ jobs:
     environment: github-pages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - uses: actions/deploy-pages@v4.0.5
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index b8f94cdcb..af29512cd 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - uses: actions/github-script@v7.0.1
         with:
           script: |
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 7607a2551..0ae6ef394 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -31,11 +31,11 @@ jobs:
       # Bazel fails if the username is unknown.
       USER: runner
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       # Stash the timestamp for the commit SHA that triggered the workflow.
       - run: echo "timestamp=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
         shell: bash
-      - uses: bazel-contrib/setup-bazel@0.8.2
+      - uses: bazel-contrib/setup-bazel@0.8.4
         with:
           bazelisk-version: '1.x'
       - name: Prepare Python ${{ matrix.ver }} environment
@@ -87,11 +87,11 @@ jobs:
       # Otherwise, Python refuses to install the built wheel!
       SYSTEM_VERSION_COMPAT: 0
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       # Stash the timestamp for the commit SHA that triggered the workflow.
       - run: echo "timestamp=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
         shell: bash
-      - uses: bazel-contrib/setup-bazel@0.8.2
+      - uses: bazel-contrib/setup-bazel@0.8.4
         with:
           bazelisk-version: '1.x'
       - uses: actions/setup-python@v5.1.0
@@ -138,11 +138,11 @@ jobs:
       BAZEL_CPU: ${{ matrix.arch.bazel-name }}_windows
       PLAT_NAME: ${{ matrix.arch.python-name }}
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       # Stash the timestamp for the commit SHA that triggered the workflow.
       - run: echo "timestamp=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
         shell: bash
-      - uses: bazel-contrib/setup-bazel@0.8.2
+      - uses: bazel-contrib/setup-bazel@0.8.4
         with:
           bazelisk-version: '1.x'
       # Lowercase the architecture name for `actions/setup-python`.
@@ -190,7 +190,7 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       # Stash the timestamp for the commit SHA that triggered the workflow.
       - run: echo "timestamp=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 59bd537be..25721ae05 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4.1.4
+      - uses: actions/checkout@v4.1.6
       - run: |
           gh release create "${GITHUB_REF_NAME}" \
             --generate-notes --latest --verify-tag \