diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ae90b0d0..c3774a3a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -66,7 +66,7 @@ jobs:
         if: steps.changed-files.outputs.files == 'true'
         run: nix build --fallback
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: steps.changed-files.outputs.files == 'true'
         with:
           name: headscale-linux
@@ -90,7 +90,7 @@ jobs:
           CGO_ENABLED: 0
         run: env ${{ matrix.env }} go build -o "headscale"
           ./cmd/headscale
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: "headscale-${{ matrix.env }}"
           path: "headscale"
diff --git a/.github/workflows/container-main.yml b/.github/workflows/container-main.yml
index 67a73ba5..0fa4373f 100644
--- a/.github/workflows/container-main.yml
+++ b/.github/workflows/container-main.yml
@@ -106,7 +106,7 @@ jobs:
           GOARCH: ${{ matrix.goarch }}
         run: go build -o headscale ./cmd/headscale
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: headscale-${{ matrix.goos }}-${{ matrix.goarch }}
           path: headscale
diff --git a/.github/workflows/integration-test-template.yml b/.github/workflows/integration-test-template.yml
index a92f6d54..039a6d51 100644
--- a/.github/workflows/integration-test-template.yml
+++ b/.github/workflows/integration-test-template.yml
@@ -42,33 +42,33 @@ jobs:
         if: ${{ env.HAS_TAILSCALE_SECRET }}
         uses: alexellis/setup-sshd-actor@master
       - name: Download headscale image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: headscale-image
           path: /tmp/artifacts
       - name: Download tailscale HEAD image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: tailscale-head-image
           path: /tmp/artifacts
       - name: Download tailscale released images
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: tailscale-released-images
           path: /tmp/artifacts
       - name: Download hi binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: hi-binary
           path: /tmp/artifacts
       - name: Download integration test binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: integration-test-binary
           path: /tmp/artifacts
       - name: Download postgres image
         if: ${{ inputs.postgres_flag == '--postgres=1' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: postgres-image
           path: /tmp/artifacts
@@ -128,12 +128,12 @@ jobs:
         run: echo "name=${TEST_NAME//[\":<>|*?\\\/]/-}" >> "$GITHUB_OUTPUT"
         env:
           TEST_NAME: ${{ inputs.test }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: ${{ inputs.database_name }}-${{ steps.sanitize.outputs.name }}-logs
           path: "control_logs/*/*.log"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: ${{ inputs.database_name }}-${{ steps.sanitize.outputs.name }}-artifacts
diff --git a/.github/workflows/needs-more-info-timer.yml b/.github/workflows/needs-more-info-timer.yml
index 27d820e7..441918e3 100644
--- a/.github/workflows/needs-more-info-timer.yml
+++ b/.github/workflows/needs-more-info-timer.yml
@@ -35,7 +35,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: hustcer/setup-nu@9215c80adb545a85c419d5085b76eb6d082f49e7 # v3.27
+      - uses: hustcer/setup-nu@95cd3bfe252450ef7d35dd9a7ddecf3484341134 # v3.28
         with:
           version: "*"
 
diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index 51bf2733..efd9a9db 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -56,14 +56,14 @@ jobs:
           CGO_ENABLED=0 GOOS=linux go test -c ./integration -o integration.test
       - name: Upload hi binary
         if: steps.changed-files.outputs.files == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: hi-binary
           path: hi
           retention-days: 10
       - name: Upload integration test binary
         if: steps.changed-files.outputs.files == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: integration-test-binary
           path: integration.test
@@ -106,14 +106,14 @@ jobs:
           docker save tailscale-head:${{ github.sha }} | gzip > tailscale-head-image.tar.gz
       - name: Upload headscale image
         if: steps.changed-files.outputs.files == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: headscale-image
           path: headscale-image.tar.gz
           retention-days: 10
       - name: Upload tailscale HEAD image
         if: steps.changed-files.outputs.files == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: tailscale-head-image
           path: tailscale-head-image.tar.gz
@@ -146,7 +146,7 @@ jobs:
           docker tag postgres:latest postgres:${{ github.sha }}
           docker save postgres:${{ github.sha }} | gzip > postgres-image.tar.gz
       - name: Upload postgres image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: postgres-image
           path: postgres-image.tar.gz
@@ -205,7 +205,7 @@ jobs:
           docker save ${REFS} | gzip > tailscale-released-images.tar.gz
           ls -lh tailscale-released-images.tar.gz
       - name: Upload Tailscale released images
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: tailscale-released-images
           path: tailscale-released-images.tar.gz