diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 44da94e..bacabb7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     name: REUSE licensing compliance
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate SPDX and license metadata
         run: |
@@ -31,7 +31,7 @@ jobs:
       CC: clang
       CXX: clang++
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Clang
         run: sudo apt-get update && sudo apt-get install -y clang
@@ -44,7 +44,7 @@ jobs:
     name: Distribution smoke tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate relocatable CMake and pkg-config packages
         shell: bash
@@ -70,7 +70,7 @@ jobs:
     name: Conan 2 package consumer
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Conan
         run: |
@@ -86,7 +86,7 @@ jobs:
     name: vcpkg overlay package consumer
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure vcpkg path
         shell: bash
@@ -140,7 +140,7 @@ jobs:
       CC: ${{ matrix.cc }}
       CXX: ${{ matrix.cxx }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install GCC
         if: matrix.os == 'ubuntu-latest' && matrix.toolchain == 'gcc'
@@ -166,7 +166,7 @@ jobs:
     name: Build and test (Windows / MSVC)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure
         run: cmake -S . -B out/build-msvc -A x64
@@ -195,7 +195,7 @@ jobs:
     name: Format check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install clang-format
         run: sudo apt-get update && sudo apt-get install -y clang-format
@@ -211,7 +211,7 @@ jobs:
       CC: clang
       CXX: clang++
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install clang-tidy toolchain
         run: sudo apt-get update && sudo apt-get install -y clang clang-tidy
@@ -224,7 +224,7 @@ jobs:
     name: Benchmark smoke test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build and run baseline benchmarks
         shell: bash
@@ -234,10 +234,10 @@ jobs:
     name: Benchmark comparison smoke test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Cache benchmark dependencies
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .benchmark-deps
           key: ${{ runner.os }}-benchmark-deps-v3.11.3-v1.1.0-v3.12.2
@@ -255,19 +255,19 @@ jobs:
       PJSON_JSONTESTSUITE_DIR: ${{ github.workspace }}/.test-corpora/JSONTestSuite
       PJSON_JSON_SCHEMA_TEST_SUITE_DIR: ${{ github.workspace }}/.test-corpora/JSON-Schema-Test-Suite
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Clang
         run: sudo apt-get update && sudo apt-get install -y clang
 
       - name: Cache JSONTestSuite corpus
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .test-corpora/JSONTestSuite
           key: ${{ runner.os }}-jsontestsuite-${{ hashFiles('scripts/fetch-json-test-suite.sh') }}
 
       - name: Cache JSON Schema corpus
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .test-corpora/JSON-Schema-Test-Suite
           key: ${{ runner.os }}-json-schema-suite-${{ hashFiles('scripts/fetch-json-schema-test-suite.sh') }}
@@ -301,19 +301,19 @@ jobs:
       PJSON_JSONTESTSUITE_DIR: ${{ github.workspace }}/.test-corpora/JSONTestSuite
       PJSON_JSON_SCHEMA_TEST_SUITE_DIR: ${{ github.workspace }}/.test-corpora/JSON-Schema-Test-Suite
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Clang
         run: sudo apt-get update && sudo apt-get install -y clang
 
       - name: Cache JSONTestSuite corpus
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .test-corpora/JSONTestSuite
           key: ${{ runner.os }}-jsontestsuite-${{ hashFiles('scripts/fetch-json-test-suite.sh') }}
 
       - name: Cache JSON Schema corpus
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .test-corpora/JSON-Schema-Test-Suite
           key: ${{ runner.os }}-json-schema-suite-${{ hashFiles('scripts/fetch-json-schema-test-suite.sh') }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b17a48a..24c6bf9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 6542f07..ad5f588 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,7 +18,7 @@ jobs:
     name: Build and validate API reference
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Doxygen
         run: sudo apt-get update && sudo apt-get install -y doxygen
@@ -35,7 +35,7 @@ jobs:
         run: cmake --build out/build-docs --target pjson-docs-check
 
       - name: Upload browsable reference
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pjson-api-reference
           path: out/build-docs/docs/reference/html
@@ -46,7 +46,7 @@ jobs:
           github.ref == 'refs/heads/main' &&
           (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         id: pages-artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: out/build-docs/docs/reference/html
 
@@ -68,11 +68,11 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
 
   release-archive:
     name: Attach API reference to release
@@ -83,7 +83,7 @@ jobs:
       contents: write
     steps:
       - name: Download generated reference
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pjson-api-reference
           path: reference-html