diff --git a/.github/workflows/agentics-maintenance.yml b/.github/workflows/agentics-maintenance.yml
index 61fcd5b..ec92216 100644
--- a/.github/workflows/agentics-maintenance.yml
+++ b/.github/workflows/agentics-maintenance.yml
@@ -208,7 +208,7 @@ jobs:
       - name: Install gh-aw
         uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
-          version: v0.88.2
+          version: v0.93.5
 
       - name: Run operation
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -360,7 +360,7 @@ jobs:
       - name: Install gh-aw
         uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
-          version: v0.88.2
+          version: v0.93.5
 
       - name: Create missing labels
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -410,7 +410,7 @@ jobs:
       - name: Install gh-aw
         uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
-          version: v0.88.2
+          version: v0.93.5
 
       - name: Restore activity report logs cache
         id: activity_report_logs_cache
@@ -517,7 +517,7 @@ jobs:
       - name: Install gh-aw
         uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
-          version: v0.88.2
+          version: v0.93.5
 
       - name: Restore forecast report logs cache
         id: forecast_report_logs_cache
@@ -654,7 +654,7 @@ jobs:
       - name: Install gh-aw
         uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
-          version: v0.88.2
+          version: v0.93.5
 
       - name: Validate workflows and file issue on findings
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 777958b..af8dac9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ on:
 # are up to date with their .md sources.
 jobs:
   check-drift:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -46,7 +46,7 @@ jobs:
           }
 
   weekly-history-smoke:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       actions: read
       contents: read
@@ -94,7 +94,7 @@ jobs:
           NODE
 
   install-labels:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -106,7 +106,7 @@ jobs:
 
   history-immutability:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 7cb7c26..8c3fd49 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -25,4 +25,4 @@ jobs:
       - name: Install gh-aw extension
         uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
         with:
-          version: v0.88.2
+          version: v0.93.5
diff --git a/.github/workflows/install-labels-org.yml b/.github/workflows/install-labels-org.yml
index b028b1b..08c3cde 100644
--- a/.github/workflows/install-labels-org.yml
+++ b/.github/workflows/install-labels-org.yml
@@ -39,7 +39,7 @@ jobs:
     # Forks have neither the App credentials nor any business editing the
     # organization's labels.
     if: github.repository == 'bootc-dev/gh-agentic-workflows'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index aebdf7e..7b4483b 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.GH_AW_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_AW_APP_PRIVATE_KEY }}
@@ -71,7 +71,7 @@ jobs:
           gh aw compile --approve
 
       - name: Open or update a pull request with the results
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ steps.app-token.outputs.token }}
           commit-message: "build: Upgrade gh-aw to ${{ steps.install.outputs.version }}"
diff --git a/.github/workflows/weekly-history.yml b/.github/workflows/weekly-history.yml
index fbead1c..c6ea1e4 100644
--- a/.github/workflows/weekly-history.yml
+++ b/.github/workflows/weekly-history.yml
@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   collect:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Generate organization collection token
         id: collection-token
@@ -107,7 +107,7 @@ jobs:
       - name: Open or update history pull request
         id: create-pr
         if: steps.collect.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ steps.writer-token.outputs.token }}
           branch: automation/history-${{ steps.period.outputs.period }}