diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..f30062029
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# Keeps the GitHub Actions referenced in .github/workflows up to date.
+# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    # One PR per week for all action bumps instead of one PR per action.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/auto-update-app-headers.yml b/.github/workflows/auto-update-app-headers.yml
index 78e0f27a2..147bf07e1 100644
--- a/.github/workflows/auto-update-app-headers.yml
+++ b/.github/workflows/auto-update-app-headers.yml
@@ -20,21 +20,21 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
           private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
 
       # Step 1: Checkout repository
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v7
 
       # Step 2: Disable file mode changes detection
       - name: Disable file mode changes
diff --git a/.github/workflows/autolabeler.yml b/.github/workflows/autolabeler.yml
index 78695b181..14a395c64 100644
--- a/.github/workflows/autolabeler.yml
+++ b/.github/workflows/autolabeler.yml
@@ -16,13 +16,13 @@ jobs:
       CONFIG_PATH: .github/autolabeler-config.json
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install dependencies
         run: npm install minimatch
 
       - name: Label PR based on file changes, title, and PR template
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs').promises;
diff --git a/.github/workflows/changelog-archive.yml b/.github/workflows/changelog-archive.yml
index 0a021ca2e..2df3ca0c6 100644
--- a/.github/workflows/changelog-archive.yml
+++ b/.github/workflows/changelog-archive.yml
@@ -19,25 +19,25 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
           private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Archive old changelog entries
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs').promises;
diff --git a/.github/workflows/changelog-pr.yml b/.github/workflows/changelog-pr.yml
index 24bc6128d..e77405524 100644
--- a/.github/workflows/changelog-pr.yml
+++ b/.github/workflows/changelog-pr.yml
@@ -19,20 +19,20 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
           private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -53,7 +53,7 @@ jobs:
 
       - name: Get categorized pull requests
         id: get-categorized-prs
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             async function main() {
@@ -213,7 +213,7 @@ jobs:
             return await main();
 
       - name: Update CHANGELOG.md
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs').promises;
diff --git a/.github/workflows/check-node-versions.yml b/.github/workflows/check-node-versions.yml
index 86b8e8f09..b2c364e41 100644
--- a/.github/workflows/check-node-versions.yml
+++ b/.github/workflows/check-node-versions.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: main
 
diff --git a/.github/workflows/close-invalid-pr-template.yml b/.github/workflows/close-invalid-pr-template.yml
index ce4c9a1bb..ab77367ac 100644
--- a/.github/workflows/close-invalid-pr-template.yml
+++ b/.github/workflows/close-invalid-pr-template.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Close PR if it does not follow the PR template
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
diff --git a/.github/workflows/close-new-script-prs.yml b/.github/workflows/close-new-script-prs.yml
index d7b6d2458..9ac26151b 100644
--- a/.github/workflows/close-new-script-prs.yml
+++ b/.github/workflows/close-new-script-prs.yml
@@ -14,7 +14,7 @@ jobs:
       contents: read
     steps:
       - name: Close PR if unauthorized new script submission
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;
diff --git a/.github/workflows/close-tteck-issues.yaml b/.github/workflows/close-tteck-issues.yaml
index 2d564c1ce..53f6736e9 100644
--- a/.github/workflows/close-tteck-issues.yaml
+++ b/.github/workflows/close-tteck-issues.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Auto-close if tteck script detected
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const issue = context.payload.issue;
diff --git a/.github/workflows/close_issue_in_dev.yaml b/.github/workflows/close_issue_in_dev.yaml
index fe502d72f..a8efe4281 100644
--- a/.github/workflows/close_issue_in_dev.yaml
+++ b/.github/workflows/close_issue_in_dev.yaml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout target repo (merge commit)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: community-scripts/ProxmoxVE
           ref: ${{ github.event.pull_request.merge_commit_sha }}
diff --git a/.github/workflows/delete-merged-branches.yml b/.github/workflows/delete-merged-branches.yml
index 09a9f8ab1..1d82f39eb 100644
--- a/.github/workflows/delete-merged-branches.yml
+++ b/.github/workflows/delete-merged-branches.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Delete branches of merged PRs
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const owner = context.repo.owner;
diff --git a/.github/workflows/delete-pocketbase-entry-on-removal.yml b/.github/workflows/delete-pocketbase-entry-on-removal.yml
index 2cf7b46b8..f8027738d 100644
--- a/.github/workflows/delete-pocketbase-entry-on-removal.yml
+++ b/.github/workflows/delete-pocketbase-entry-on-removal.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
index f4b49ff7d..ab216bd42 100644
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -13,7 +13,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Clean CHANGELOG (remove HTML header)
         run: sed -n '/^## /,$p' CHANGELOG.md > changelog_cleaned.md
diff --git a/.github/workflows/lock-issue.yaml b/.github/workflows/lock-issue.yaml
index 7d97ed720..cdce75f67 100644
--- a/.github/workflows/lock-issue.yaml
+++ b/.github/workflows/lock-issue.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lock old issues and PRs
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const daysBeforeLock = 7;
diff --git a/.github/workflows/pocketbase-ai-bot.yml b/.github/workflows/pocketbase-ai-bot.yml
index abe117962..e3840ea64 100644
--- a/.github/workflows/pocketbase-ai-bot.yml
+++ b/.github/workflows/pocketbase-ai-bot.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: Mint GitHub App token (bot identity)
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.PB_BOT_APP_ID }}
           private-key: ${{ secrets.PB_BOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/push-json-to-pocketbase.yml b/.github/workflows/push-json-to-pocketbase.yml
index 9538c662c..9a58adf90 100644
--- a/.github/workflows/push-json-to-pocketbase.yml
+++ b/.github/workflows/push-json-to-pocketbase.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/stale_pr_close.yml b/.github/workflows/stale_pr_close.yml
index 1a97a01a4..c26e1002c 100644
--- a/.github/workflows/stale_pr_close.yml
+++ b/.github/workflows/stale_pr_close.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: Handle stale PRs
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const now = new Date();
diff --git a/.github/workflows/trigger_github_pages_redirect.yml b/.github/workflows/trigger_github_pages_redirect.yml
index 41a8c38a8..ba6d40357 100644
--- a/.github/workflows/trigger_github_pages_redirect.yml
+++ b/.github/workflows/trigger_github_pages_redirect.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Create redirect page
         run: |
@@ -33,9 +33,9 @@ jobs:
           </html>
           EOF
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
       - name: Deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/update-script-timestamp-on-sh-change.yml b/.github/workflows/update-script-timestamp-on-sh-change.yml
index 916df6a58..f2f271845 100644
--- a/.github/workflows/update-script-timestamp-on-sh-change.yml
+++ b/.github/workflows/update-script-timestamp-on-sh-change.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0