diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 44c3d17276..800616ae98 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -29,11 +29,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: '3.9'
     - name: Install dependencies
@@ -42,7 +42,7 @@ jobs:
         pip3 install .
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: python
         # Override the default behavior so that the action doesn't attempt
@@ -53,4 +53,4 @@ jobs:
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index d7132a4ff0..a77ea61b05 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - Type consistency (mypy)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -41,10 +41,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - PEP8 & more (ruff)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -58,10 +58,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - Import order (isort)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -76,10 +76,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - Code format (black)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -93,10 +93,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - Spellcheck (codespell, typos)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -110,10 +110,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - Hotkeys & docs sync (lint-hotkeys)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -127,10 +127,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint - Docstrings & docs sync (lint-docstring)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
           cache: 'pip'
@@ -149,12 +149,12 @@ jobs:
         run: echo "PR_FETCH_DEPTH=$(( ${{ github.event.pull_request.commits }} + 1 ))" >> "${GITHUB_ENV}"
       - name: 'Checkout PR branch and all PR commits'
         if: github.event_name == 'pull_request'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: ${{ env.PR_FETCH_DEPTH }}
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         if: github.event_name == 'pull_request'
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
@@ -173,11 +173,11 @@ jobs:
     runs-on: ubuntu-22.04
     name: Install & test - CPython 3.7 (ubuntu), codecov
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Install Python version
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.7
           cache: 'pip'
@@ -193,7 +193,9 @@ jobs:
       - name: Run tests with pytest
         run: pytest --cov-report=xml
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   isolated-commits:
     runs-on: ubuntu-latest
@@ -209,13 +211,13 @@ jobs:
       - base_pytest
       - gitlint
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: github.event_name == 'pull_request'
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         if: github.event_name == 'pull_request'
         with:
           python-version: ${{ env.LINTING_PYTHON_VERSION }}
@@ -250,11 +252,11 @@ jobs:
     runs-on: ${{ matrix.env.OS }}
     name: Install & test - ${{ matrix.env.NAME}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: Install Python version ${{ matrix.env.PYTHON }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.env.PYTHON }}
           cache: 'pip'