diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 6b27d70..09bab7e 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -53,7 +53,7 @@ jobs:
       - name: Run Clippy
         continue-on-error: true
         run: |
-          set -euxo pipefail
+          set -euo pipefail
 
           cargo clippy \
             --all-features \
@@ -62,7 +62,7 @@ jobs:
           | clippy-sarif | tee /tmp/clippy.sarif | sarif-fmt
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: /tmp/clippy.sarif
           wait-for-processing: true
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 891362b..7138f6e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -9,8 +9,8 @@ on:
 jobs:
   build:
     name: Build image
-
     runs-on: ubuntu-latest
+
     strategy:
       matrix:
         arch: [x86_64, aarch64]
@@ -32,7 +32,7 @@ jobs:
           echo "path=$(realpath result)" >> "$GITHUB_OUTPUT"
 
       - name: Upload image
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: container-${{ matrix.arch }}
           path: ${{ steps.build.outputs.path }}
@@ -59,7 +59,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Download images
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           path: images
 
@@ -74,7 +74,7 @@ jobs:
         env:
           TAG: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
         run: |
-          set -eux
+          set -eu
 
           architectures=("x86_64" "aarch64")
           for arch in "${architectures[@]}"; do
diff --git a/.github/workflows/update-flake.yml b/.github/workflows/update-flake.yml
index 014a603..fabcaf0 100644
--- a/.github/workflows/update-flake.yml
+++ b/.github/workflows/update-flake.yml
@@ -23,6 +23,6 @@ jobs:
       - name: Update and create PR
         uses: DeterminateSystems/update-flake-lock@v20
         with:
-          commit-msg: 'flake: update inputs'
-          pr-title: 'flake: update inputs'
+          commit-msg: 'nix: update inputs'
+          pr-title: 'nix: update inputs'
           token: ${{ github.token }}