diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 45c6241dff..7b453835ca 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -35,13 +35,13 @@ jobs:
         uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c #v3.1.0
 
       - name: DockerHub Registry Login
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
       - name: Github Registry login
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -77,7 +77,7 @@ jobs:
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Build and push centrifugeio/centrifuge-chain
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 #v5.1.0
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 #v5.1.0
         with:
           context: .
           file: ./docker/centrifuge-chain/Dockerfile
diff --git a/.github/workflows/build-wasm.yml b/.github/workflows/build-wasm.yml
index 92b5a632f0..e92cfa624f 100644
--- a/.github/workflows/build-wasm.yml
+++ b/.github/workflows/build-wasm.yml
@@ -33,7 +33,7 @@ jobs:
         uses: ./.github/actions/prep-ubuntu
 
       # sccache does not work inside the srtool container
-      - uses: Swatinem/rust-cache@3cf7f8cc28d1b4e7d01e3783be10a97d55d483c8 # 2.7
+      - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # 2.7
         with:
           prefix-key: build
           shared-key: wasm
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 9b70e7b7ac..7d3dad762c 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -49,7 +49,7 @@ jobs:
           echo "<meta http-equiv=\"refresh\" content=\"0; url=centrifuge_chain/index.html\">" \ > ./target/doc/index.html
 
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v5
 
       - name: Fix permissions
         run: |
diff --git a/.github/workflows/try-runtime.yml b/.github/workflows/try-runtime.yml
index ee92b7f6f4..db72231f7b 100644
--- a/.github/workflows/try-runtime.yml
+++ b/.github/workflows/try-runtime.yml
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify Slack
-        uses: rtCamp/action-slack-notify@b24d75fe0e728a4bf9fc42ee217caa686d141ee8 #v2.2.1
+        uses: rtCamp/action-slack-notify@4e5fb42d249be6a45a298f3c9543b111b02f7907 #v2.3.0
         env:
           SLACK_CHANNEL: eng-protocol-general
           SLACK_COLOR: '#FF0000'
diff --git a/scripts/upgrade-github-actions.sh b/scripts/upgrade-github-actions.sh
new file mode 100644
index 0000000000..79d0172998
--- /dev/null
+++ b/scripts/upgrade-github-actions.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# This script will use the open dependabot PRs to peform an upgrade of all GH actions
+
+# The target branch to merge all Dependabot PRs into
+TARGET_BRANCH="upgrade-gh-actions"
+
+# Ensure the target branch exists and is checked out
+git checkout -b $TARGET_BRANCH 2>/dev/null || git checkout $TARGET_BRANCH
+
+# Fetch all PRs from GitHub, filter for those opened by Dependabot, and extract their branch names
+gh pr list --search "author:app/dependabot" --state open --json headRefName --jq '.[].headRefName' | while read branch; do
+    # Merge each Dependabot branch into the target branch
+    echo "Merging $branch into $TARGET_BRANCH..."
+    git merge origin/$branch --no-edit
+done
+
+# After merging, you might want to push the changes
+# git push origin $TARGET_BRANCH
\ No newline at end of file