diff --git a/.github/workflows/benchmark_tests.yml b/.github/workflows/benchmark_tests.yml
index 3493e5048..5bf099415 100644
--- a/.github/workflows/benchmark_tests.yml
+++ b/.github/workflows/benchmark_tests.yml
@@ -72,19 +72,19 @@ jobs:
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -95,7 +95,7 @@ jobs:
       # from source-copy, so code-only changes skip the slow uv-sync layer
       # when the runner has a warm Docker daemon cache.
       - name: Build Libero benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.libero
@@ -151,7 +151,7 @@ jobs:
 
       - name: Upload Libero rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: libero-rollout-video
           path: /tmp/libero-artifacts/videos/
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload Libero eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: libero-metrics
           path: /tmp/libero-artifacts/metrics.json
@@ -214,7 +214,7 @@ jobs:
 
       - name: Upload Libero train-smoke eval video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: libero-train-smoke-video
           path: /tmp/libero-train-smoke-artifacts/eval/
@@ -230,19 +230,19 @@ jobs:
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -250,7 +250,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
 
       - name: Build MetaWorld benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.metaworld
@@ -303,7 +303,7 @@ jobs:
 
       - name: Upload MetaWorld rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: metaworld-rollout-video
           path: /tmp/metaworld-artifacts/videos/
@@ -311,7 +311,7 @@ jobs:
 
       - name: Upload MetaWorld eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: metaworld-metrics
           path: /tmp/metaworld-artifacts/metrics.json
@@ -332,19 +332,19 @@ jobs:
       ROBOTWIN_TASKS: beat_block_hammer,click_bell,handover_block,stack_blocks_two,click_alarmclock,open_microwave,adjust_bottle,lift_pot,stamp_seal,turn_switch
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -355,7 +355,7 @@ jobs:
       # simulation assets (~4 GB). Layer cache lives in the runner's local
       # Docker daemon — reused across re-runs on the same machine.
       - name: Build RoboTwin 2.0 benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.robotwin
@@ -413,7 +413,7 @@ jobs:
 
       - name: Upload RoboTwin rollout video
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: robotwin-rollout-video
           path: /tmp/robotwin-artifacts/videos/
@@ -421,7 +421,7 @@ jobs:
 
       - name: Upload RoboTwin eval metrics
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: robotwin-metrics
           path: /tmp/robotwin-artifacts/metrics.json
@@ -439,19 +439,19 @@ jobs:
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -459,7 +459,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
 
       - name: Build RoboCasa365 benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.robocasa
@@ -514,7 +514,7 @@ jobs:
 
       - name: Upload RoboCasa365 rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: robocasa-rollout-video
           path: /tmp/robocasa-artifacts/videos/
@@ -522,7 +522,7 @@ jobs:
 
       - name: Upload RoboCasa365 eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: robocasa-metrics
           path: /tmp/robocasa-artifacts/metrics.json
@@ -540,19 +540,19 @@ jobs:
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -560,7 +560,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
 
       - name: Build RoboCerebra benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.robocerebra
@@ -621,7 +621,7 @@ jobs:
 
       - name: Upload RoboCerebra rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: robocerebra-rollout-video
           path: /tmp/robocerebra-artifacts/videos/
@@ -629,7 +629,7 @@ jobs:
 
       - name: Upload RoboCerebra eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: robocerebra-metrics
           path: /tmp/robocerebra-artifacts/metrics.json
@@ -648,19 +648,19 @@ jobs:
       ROBOMME_TASKS: PickXtimes,BinFill,StopCube,MoveCube,InsertPeg,SwingXtimes,VideoUnmask,ButtonUnmask,PickHighlight,PatternLock
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -668,7 +668,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
 
       - name: Build RoboMME benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.robomme
@@ -726,7 +726,7 @@ jobs:
 
       - name: Upload RoboMME rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: robomme-rollout-video
           path: /tmp/robomme-artifacts/videos/
@@ -734,7 +734,7 @@ jobs:
 
       - name: Upload RoboMME eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: robomme-metrics
           path: /tmp/robomme-artifacts/metrics.json
@@ -754,19 +754,19 @@ jobs:
       LIBERO_PLUS_TASK_IDS: "[0,100,260,500,1000,1500,2000,2400]"
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -774,7 +774,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
 
       - name: Build LIBERO-plus benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.libero_plus
@@ -834,7 +834,7 @@ jobs:
 
       - name: Upload LIBERO-plus rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: libero-plus-rollout-video
           path: /tmp/libero-plus-artifacts/videos/
@@ -842,7 +842,7 @@ jobs:
 
       - name: Upload LIBERO-plus eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: libero-plus-metrics
           path: /tmp/libero-plus-artifacts/metrics.json
@@ -858,19 +858,19 @@ jobs:
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
 
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
@@ -878,7 +878,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
 
       - name: Build VLABench benchmark image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: docker/Dockerfile.benchmark.vlabench
@@ -936,7 +936,7 @@ jobs:
 
       - name: Upload VLABench rollout video
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: vlabench-rollout-video
           path: /tmp/vlabench-artifacts/videos/
@@ -944,7 +944,7 @@ jobs:
 
       - name: Upload VLABench eval metrics
         if: always()
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: vlabench-metrics
           path: /tmp/vlabench-artifacts/metrics.json
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index b08b82a06..13513da30 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -47,7 +47,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/docker_publish.yml b/.github/workflows/docker_publish.yml
index 498b9c164..e185240b4 100644
--- a/.github/workflows/docker_publish.yml
+++ b/.github/workflows/docker_publish.yml
@@ -52,21 +52,21 @@ jobs:
           sudo apt-get update
           sudo apt-get install git-lfs
           git lfs install
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
           persist-credentials: false
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
       - name: Login to Docker Hub
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
       - name: Build and push Docker image CPU
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: ./docker/Dockerfile.user
@@ -87,21 +87,21 @@ jobs:
           sudo apt-get update
           sudo apt-get install git-lfs
           git lfs install
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
           persist-credentials: false
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
       - name: Login to Docker Hub
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
       - name: Build and push Docker image GPU
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: ./docker/Dockerfile.internal
diff --git a/.github/workflows/documentation-upload-pr.yml b/.github/workflows/documentation-upload-pr.yml
index 85a6ba934..9a08e816b 100644
--- a/.github/workflows/documentation-upload-pr.yml
+++ b/.github/workflows/documentation-upload-pr.yml
@@ -33,7 +33,7 @@ jobs:
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.repository == 'huggingface/lerobot'
-    uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@2430c1ec91d04667414e2fa31ecfc36c153ea391  # main
+    uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@6108e850ae1cf2f71bb0815a600bcd50c39abfa7  # main
     with:
       package_name: lerobot
     secrets:
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index dc312c6df..f423d48ee 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -55,7 +55,7 @@ jobs:
       github.repository == 'huggingface/lerobot'
     permissions:
       contents: read
-    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@e60a538eea9817ab312196d0d233604b01697265  # main
+    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@6108e850ae1cf2f71bb0815a600bcd50c39abfa7  # main
     with:
       commit_sha: ${{ github.sha }}
       package: lerobot
@@ -78,7 +78,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@e60a538eea9817ab312196d0d233604b01697265  # main
+    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@6108e850ae1cf2f71bb0815a600bcd50c39abfa7  # main
     with:
       commit_sha: ${{ github.event.pull_request.head.sha }}
       pr_number: ${{ github.event.number }}
diff --git a/.github/workflows/fast_tests.yml b/.github/workflows/fast_tests.yml
index b6680db73..a55aa84d1 100644
--- a/.github/workflows/fast_tests.yml
+++ b/.github/workflows/fast_tests.yml
@@ -69,7 +69,7 @@ jobs:
       HF_LEROBOT_HOME: /mnt/cache/.cache/huggingface/lerobot
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
@@ -87,7 +87,7 @@ jobs:
           libusb-1.0-0-dev speech-dispatcher libgeos-dev portaudio19-dev
 
       - name: Setup uv and Python
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e  # v6
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
         with:
           enable-cache: true
           version: ${{ env.UV_VERSION }}
diff --git a/.github/workflows/full_tests.yml b/.github/workflows/full_tests.yml
index c672689d8..1ddb61092 100644
--- a/.github/workflows/full_tests.yml
+++ b/.github/workflows/full_tests.yml
@@ -63,7 +63,7 @@ jobs:
       HF_LEROBOT_HOME: /mnt/cache/.cache/huggingface/lerobot
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           lfs: true
           persist-credentials: false
@@ -80,7 +80,7 @@ jobs:
           speech-dispatcher libgeos-dev portaudio19-dev
 
       - name: Setup uv and Python
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e  # v6
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
         with:
           enable-cache: true
           version: ${{ env.UV_VERSION }}
@@ -137,21 +137,21 @@ jobs:
           sudo apt-get update
           sudo apt-get install git-lfs
           git lfs install
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           lfs: true
           persist-credentials: false
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
         with:
           cache-binary: false
       - name: Login to Docker Hub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
       - name: Build and push Docker image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
         with:
           context: .
           file: ./docker/Dockerfile.internal
diff --git a/.github/workflows/issue_labeler.yml b/.github/workflows/issue_labeler.yml
index 438184e3f..92d22f500 100644
--- a/.github/workflows/issue_labeler.yml
+++ b/.github/workflows/issue_labeler.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'huggingface/lerobot'
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             // Setup Input Text
diff --git a/.github/workflows/latest_deps_tests.yml b/.github/workflows/latest_deps_tests.yml
index 2a7564d11..643c0f940 100644
--- a/.github/workflows/latest_deps_tests.yml
+++ b/.github/workflows/latest_deps_tests.yml
@@ -48,12 +48,12 @@ jobs:
     outputs:
       changed: ${{ steps.diff.outputs.changed }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Setup uv and Python
-        uses: astral-sh/setup-uv@v6 # zizmor: ignore[unpinned-uses]
+        uses: astral-sh/setup-uv@v8.3.2 # zizmor: ignore[unpinned-uses]
         with:
           version: ${{ env.UV_VERSION }}
           python-version: ${{ env.PYTHON_VERSION }}
@@ -74,7 +74,7 @@ jobs:
 
       - name: Upload updated lockfile
         if: steps.diff.outputs.changed == 'true'
-        uses: actions/upload-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/upload-artifact@v7 # zizmor: ignore[unpinned-uses]
         with:
           name: uv-lock
           path: uv.lock
@@ -93,13 +93,13 @@ jobs:
       HF_LEROBOT_HOME: /mnt/cache/.cache/huggingface/lerobot
       HF_USER_TOKEN: ${{ secrets.LEROBOT_HF_USER }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
           persist-credentials: false
 
       - name: Download updated lockfile
-        uses: actions/download-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/download-artifact@v8 # zizmor: ignore[unpinned-uses]
         with:
           name: uv-lock
 
@@ -115,7 +115,7 @@ jobs:
           speech-dispatcher libgeos-dev portaudio19-dev
 
       - name: Setup uv and Python
-        uses: astral-sh/setup-uv@v6 # zizmor: ignore[unpinned-uses]
+        uses: astral-sh/setup-uv@v8.3.2 # zizmor: ignore[unpinned-uses]
         with:
           enable-cache: true
           version: ${{ env.UV_VERSION }}
@@ -153,27 +153,27 @@ jobs:
           sudo apt-get update
           sudo apt-get install git-lfs
           git lfs install
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           lfs: true
           persist-credentials: false
 
       - name: Download updated lockfile
-        uses: actions/download-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/download-artifact@v8 # zizmor: ignore[unpinned-uses]
         with:
           name: uv-lock
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/setup-buildx-action@v4 # zizmor: ignore[unpinned-uses]
         with:
           cache-binary: false
       - name: Login to Docker Hub
-        uses: docker/login-action@v3 # zizmor: ignore[unpinned-uses]
+        uses: docker/login-action@v4.4.0 # zizmor: ignore[unpinned-uses]
         with:
           username: ${{ secrets.DOCKERHUB_LEROBOT_USERNAME }}
           password: ${{ secrets.DOCKERHUB_LEROBOT_PASSWORD }}
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6 # zizmor: ignore[unpinned-uses]
+        uses: docker/build-push-action@v7 # zizmor: ignore[unpinned-uses]
         with:
           context: .
           file: ./docker/Dockerfile.internal
@@ -247,12 +247,12 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.UPDATE_LOCK_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Download updated lockfile
-        uses: actions/download-artifact@v4 # zizmor: ignore[unpinned-uses]
+        uses: actions/download-artifact@v8 # zizmor: ignore[unpinned-uses]
         with:
           name: uv-lock
 
diff --git a/.github/workflows/pr_labeler.yml b/.github/workflows/pr_labeler.yml
index 177c20959..5eb49605d 100644
--- a/.github/workflows/pr_labeler.yml
+++ b/.github/workflows/pr_labeler.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'huggingface/lerobot' && !github.event.pull_request.draft
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@v7
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           sync-labels: true # Removes labels if files are removed from the PR
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index a7c49076d..d66734491 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -43,12 +43,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v6
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1b4088ad7..fbf1fff04 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,12 +38,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v6
         with:
           python-version: '3.12'
 
@@ -104,7 +104,7 @@ jobs:
       - name: Publish to TestPyPI for pre-releases
         # True for tags like 'v0.2.0-rc1'
         if: startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-')
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1
         with:
           repository-url: https://test.pypi.org/legacy/
           verbose: true
@@ -112,7 +112,7 @@ jobs:
 
       - name: Publish to PyPI
         if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-')
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1
         with:
           verbose: true
           print-hash: true
@@ -127,7 +127,7 @@ jobs:
     env:
       MUJOCO_GL: egl
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           lfs: true
           persist-credentials: false
@@ -137,7 +137,7 @@ jobs:
           git curl libglib2.0-0 libegl1-mesa-dev ffmpeg libusb-1.0-0-dev \
           speech-dispatcher libgeos-dev portaudio19-dev
       - name: Setup uv and Python
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e  # v6
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
         with:
           enable-cache: true # zizmor: ignore[cache-poisoning]
           version: ${{ env.UV_VERSION }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 8e2af59ca..87968a78d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -43,12 +43,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Secret Scanning
-        uses: trufflesecurity/trufflehog@eafb8c5f6a06175141c27f17bcc17941853d0047  # v3.90.0
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55  # v3.95.9
         with:
           extra_args: --only-verified