diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml
index 7c692f6e5..057b923fc 100644
--- a/.github/workflows/build_wheels.yml
+++ b/.github/workflows/build_wheels.yml
@@ -60,7 +60,7 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
 
     - name: Build sdist
       env:
@@ -90,20 +90,20 @@ jobs:
     
     steps:
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       # Get Python 3.12 x32 and x64 on Windows. (As of 2023-10-12 these are not
       # always available by default.)
       #
       - name: Install Python 3.12 x32 on Windows.
         if: runner.os == 'Windows'
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: '3.12'
           architecture: x86
       - name: Install Python 3.12 x64 on Windows.
         if: runner.os == 'Windows'
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: '3.12'
 
@@ -115,7 +115,7 @@ jobs:
       # `python-config3` return settings for Python-3.12, instead of for
       # whatever Python is being used by cibuildwheel.
       #
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v5
 
       # On Linux, get qemu so we can build for aarch64.
       #
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 7620b285a..456ccd1a4 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -12,7 +12,7 @@ jobs:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         # Beta Release
-        uses: contributor-assistant/github-action@v2.2.0
+        uses: contributor-assistant/github-action@v2.4.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret
diff --git a/.github/workflows/test-valgrind.yml b/.github/workflows/test-valgrind.yml
index 68a981451..c13a4225f 100644
--- a/.github/workflows/test-valgrind.yml
+++ b/.github/workflows/test-valgrind.yml
@@ -19,8 +19,8 @@ jobs:
 
     steps:
 
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
 
       - name: test_mupdf-master-branch
         env:
diff --git a/.github/workflows/test_mupdf-master-branch.yml b/.github/workflows/test_mupdf-master-branch.yml
index e40d5ee48..6571cac67 100644
--- a/.github/workflows/test_mupdf-master-branch.yml
+++ b/.github/workflows/test_mupdf-master-branch.yml
@@ -21,8 +21,8 @@ jobs:
 
     steps:
 
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
 
       - name: test_mupdf-master-branch
         env:
diff --git a/.github/workflows/test_mupdf-release-branch.yml b/.github/workflows/test_mupdf-release-branch.yml
index 0bf1a934a..bf48859d5 100644
--- a/.github/workflows/test_mupdf-release-branch.yml
+++ b/.github/workflows/test_mupdf-release-branch.yml
@@ -22,8 +22,8 @@ jobs:
 
     steps:
 
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
 
       - name: test_mupdf-release-branch
         env:
diff --git a/.github/workflows/test_pyodide.yml b/.github/workflows/test_pyodide.yml
index effcbfa2d..48945e473 100644
--- a/.github/workflows/test_pyodide.yml
+++ b/.github/workflows/test_pyodide.yml
@@ -29,9 +29,9 @@ jobs:
     
     steps:
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/test_quick.yml b/.github/workflows/test_quick.yml
index 31d9d42da..5040cf746 100644
--- a/.github/workflows/test_quick.yml
+++ b/.github/workflows/test_quick.yml
@@ -22,8 +22,8 @@ jobs:
 
     steps:
 
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
       
       - name: test_quick
 
diff --git a/.github/workflows/test_sysinstall.yml b/.github/workflows/test_sysinstall.yml
index ae42bf5fb..77c876923 100644
--- a/.github/workflows/test_sysinstall.yml
+++ b/.github/workflows/test_sysinstall.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       
       # It seems to be important not to install a custom python here,
       # because `sudo` (which we need to use when installing to /usr/local
@@ -25,7 +25,7 @@ jobs:
       # pymupdf files being installed into .../python3.11/site-packages and
       # .../python3.10/site-packages, and tests all fail to import pymupdf.
       #
-      #- uses: actions/setup-python@v2
+      #- uses: actions/setup-python@v5
         #with:
         #  # 3.12 doesn't have setuptools. As of 2024-01-03, MuPDF build requires setuptools before it
         #  # sees `--venv` and defers to a venv, so we currently have to force use of python 3.11.
diff --git a/scripts/sysinstall.py b/scripts/sysinstall.py
index 84c28f341..33e250acf 100755
--- a/scripts/sysinstall.py
+++ b/scripts/sysinstall.py
@@ -14,7 +14,7 @@
 Note that we run some commands with sudo; it's important that these use the
 same python as non-sudo, otherwise things can be build and installed for
 different python versions. For example when we are run from a github action, it
-should not do `- uses: actions/setup-python@v2` but instead use whatever system
+should not do `- uses: actions/setup-python@v5` but instead use whatever system
 python is already defined.
 
 Args: