diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 3f735f4cbd12..8ec5e77b0f21 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: "Add 'has: port to stable' label"
         if: steps.backport.outputs.created_pull_numbers != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           # Not using the app on purpose to avoid triggering another workflow run after adding this label.
           script: |
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 44ec33382e22..6f2e24948b7f 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Check commits
         id: check
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           TARGETS_STABLE: ${{ fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development') }}
         with:
diff --git a/.github/workflows/dismissed-review.yml b/.github/workflows/dismissed-review.yml
index 224ea0af7249..db5799c80913 100644
--- a/.github/workflows/dismissed-review.yml
+++ b/.github/workflows/dismissed-review.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 2
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             // PRs from forks don't have any PRs associated by default.
diff --git a/.github/workflows/edited.yml b/.github/workflows/edited.yml
index 8a38f0eefeff..e944254d19cd 100644
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@@ -43,7 +43,7 @@ jobs:
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-pull-requests: write
 
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index b2cbdf2b4c54..5907e8ae4100 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -222,7 +222,7 @@ jobs:
 
       - name: Add eval summary to commit statuses
         if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { readFile } = require('node:fs/promises')
@@ -263,7 +263,7 @@ jobs:
           path: versions
 
       - name: Add version comparison table to job summary
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           SYSTEMS: ${{ inputs.systems }}
           VERSIONS: ${{ needs.versions.outputs.versions }}
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 4dfbe74f02b8..c024a5514c0e 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -64,7 +64,7 @@ jobs:
         run: gh api /rate_limit | jq
 
       - name: Labels from API data and Eval results
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index 9af5cf0ebb71..d95c1e5ea22a 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -37,7 +37,7 @@ jobs:
     permissions:
       statuses: write
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2ab850094e33..785ebbf9d168 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -40,7 +40,7 @@ jobs:
           sparse-checkout: |
             ci/github-script
       - id: prepare
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             require('./ci/github-script/prepare.js')({
@@ -138,7 +138,7 @@ jobs:
     permissions:
       statuses: write
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { serverUrl, repo, runId, payload } = context
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 9f4e4374bb89..e0311ef4767c 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -88,7 +88,7 @@ jobs:
       # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
       # In the more special case, when a PR is undrafted an eval run will have started already.
       - name: Wait for comparison to be done
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: eval
         with:
           script: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b3c2c6c59863..e82719ab205f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,7 +25,7 @@ jobs:
           sparse-checkout: |
             ci/github-script
       - id: prepare
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             require('./ci/github-script/prepare.js')({
@@ -38,7 +38,7 @@ jobs:
 
       - name: Determine changed files
         id: files
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const files = (await github.paginate(github.rest.pulls.listFiles, {