diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 5f0d34462..2d1d11fd9 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -9,22 +9,22 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         # TODO: find a way to shallow clone precisely pr_base..pr_head;
         # wee need this context to do an adequate `darker` report.
         # as it stands this is wasteful.
         # assuming no PR has more than 50 commits.
         fetch-depth: 50
-    - uses: actions/setup-python@v4
+    - uses: actions/setup-python@v5
       with:
         python-version: '3.11'
         cache: 'pip'
     - name: "Run pre-commit hooks for HEAD"
-      uses: pre-commit/action@v3.0.0
+      uses: pre-commit/action@v3.0.1
       if: github.event_name != 'pull_request'
     - name: "Run pre-commit hooks for PR range"
-      uses: pre-commit/action@v3.0.0
+      uses: pre-commit/action@v3.0.1
       with:
         extra_args: >
           --from-ref=${{ github.event.pull_request.base.sha }}
@@ -34,10 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out pycroft and submodules
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
           cache: 'pip'
@@ -63,7 +63,7 @@ jobs:
         run: python ./scripts/render_sphinx_log.py doc/sphinx.log
         if: success() || steps.pip-install.conclusion == 'success'
       - name: Publish sphinx docs as pages artifact
-        uses: actions/upload-pages-artifact@v1
+        uses: actions/upload-pages-artifact@v3
         with:
           path: doc/_build/html
   # see https://github.com/actions/deploy-pages#usage
@@ -85,12 +85,12 @@ jobs:
     steps:
       - name: Deploy sphinx docs to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v1
+        uses: actions/deploy-pages@v4
   npm-build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-node@v3
+    - uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
       with:
         node-version: 16
     - run: npm ci
@@ -103,11 +103,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
            submodules: 'true'
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           version: v0.10.0
       - name: Fix permissions
@@ -117,7 +117,7 @@ jobs:
       - name: Build the Docker image
         run: docker buildx bake --file docker-compose.prod.yml --load
       - name: Login to GitLab Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           registry: registry.agdsn.de
           username: "github-actions"
@@ -130,11 +130,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
            submodules: 'true'
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           version: v0.10.0
       - name: Fix permissions
@@ -157,7 +157,7 @@ jobs:
           --cov=pycroft --cov=web --cov=ldap_sync --cov=hades_logs --cov-append
           --cov-report html --cov-report xml
       - name: Publish Test Report
-        uses: mikepenz/action-junit-report@v3
+        uses: mikepenz/action-junit-report@v4
         if: always() # always run even if the previous step fails
         with:
           report_paths: 'junit/test-*.xml'