diff --git a/.github/actions/setup-build/action.yaml b/.github/actions/setup-build/action.yaml
index 4ae0062ee1..9add45c7be 100644
--- a/.github/actions/setup-build/action.yaml
+++ b/.github/actions/setup-build/action.yaml
@@ -8,7 +8,7 @@ runs:
     - name: Setup Go
       uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 #v5.0.0
       with:
-        go-version: 1.20.x
+        go-version: 1.21.x
         cache: false
     - name: Cache go-build and mod
       uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
diff --git a/.github/workflows/docker-publish.yaml b/.github/workflows/docker-publish.yaml
index 0297a409c8..924e25107d 100644
--- a/.github/workflows/docker-publish.yaml
+++ b/.github/workflows/docker-publish.yaml
@@ -13,7 +13,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4 #5.3.0
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 #5.5.1
         with:
           images: weaveworks/eksctl
       - name: Log in to Docker Hub
diff --git a/.github/workflows/ecr-publish-build.yaml b/.github/workflows/ecr-publish-build.yaml
index 68b0f7a565..557ec6de86 100644
--- a/.github/workflows/ecr-publish-build.yaml
+++ b/.github/workflows/ecr-publish-build.yaml
@@ -20,7 +20,7 @@ jobs:
         uses: ./.github/actions/setup-build
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
           aws-region: us-east-1
           role-duration-seconds: 7200
diff --git a/.github/workflows/ecr-publish.yaml b/.github/workflows/ecr-publish.yaml
index 733292ca64..caf540ea9e 100644
--- a/.github/workflows/ecr-publish.yaml
+++ b/.github/workflows/ecr-publish.yaml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
           aws-region: us-east-1
           role-duration-seconds: 7200
@@ -32,7 +32,7 @@ jobs:
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4 #5.3.0
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 #5.5.1
         env:
           REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
           REGISTRY_ALIAS: eksctl
diff --git a/.github/workflows/link-checker.yaml b/.github/workflows/link-checker.yaml
index a906fefb19..3c62ff2f8d 100644
--- a/.github/workflows/link-checker.yaml
+++ b/.github/workflows/link-checker.yaml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 #v5.0.0
         with:
-          go-version: 1.20.x
+          go-version: 1.21.x
           cache: false
       - name: Install doc dependencies
         run: make install-site-deps
@@ -36,7 +36,7 @@ jobs:
         run: make build-pages
         # Using link-checker action to check links in Markdown, HTML files
       - name: Link Checker
-        uses: lycheeverse/lychee-action@ec3ed119d4f44ad2673a7232460dc7dff59d2421 #v1.8.0
+        uses: lycheeverse/lychee-action@c053181aa0c3d17606addfe97a9075a32723548a #v1.9.3
         with:
           fail: true
           args: --exclude-all-private --exclude-mail --exclude-file .github/workflows/exclude-file.txt --verbose --no-progress './**/*.md' './**/*.html'
diff --git a/.github/workflows/publish-release-type.yaml b/.github/workflows/publish-release-type.yaml
index f46a51ecf9..4f4268dfd4 100644
--- a/.github/workflows/publish-release-type.yaml
+++ b/.github/workflows/publish-release-type.yaml
@@ -27,25 +27,8 @@ jobs:
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
           echo "Available storage:"
           df -h
-      - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
-      - name: Setup Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 #v5.0.0
-        with:
-          go-version: 1.20.x
-          cache: false
-      - name: Cache go-build and mod
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 #v4.0.0
-        with:
-          path: |
-            ~/.cache/go-build/
-            ~/go/pkg/mod/
-          key: go-${{ hashFiles('go.sum') }}
-          restore-keys: |
-            go-
-      - name: Setup deps
-        run: |
-          make install-build-deps
+      - name: Setup build environment
+        uses: ./.github/actions/setup-build
       - name: Publish release
         if: ${{ !inputs.isReleaseCandidate }}
         env:
diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml
index 9db0bf4dc7..af00b4bdc6 100644
--- a/.github/workflows/release-drafter.yaml
+++ b/.github/workflows/release-drafter.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
-      - uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 #v5.25.0
+      - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 #v6.0.0
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml
diff --git a/.github/workflows/update-generated.yaml b/.github/workflows/update-generated.yaml
index 97601ac479..76c5c2e9e9 100644
--- a/.github/workflows/update-generated.yaml
+++ b/.github/workflows/update-generated.yaml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
       - name: Configure AWS credentials for coredns update
         if: ${{ matrix.resource == 'coredns' }}
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
           aws-region: us-west-2
           role-duration-seconds: 900