diff --git a/18_security/18.6_image_security.md b/18_security/18.6_image_security.md
index f21d74f..b502faf 100644
--- a/18_security/18.6_image_security.md
+++ b/18_security/18.6_image_security.md
@@ -420,14 +420,16 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
 
     - name: Install Cosign
       if: github.event_name == 'push'
-      uses: sigstore/cosign-installer@v3
+      # cosign-installer 没有发布可移动的 v4 大版本标签，只能引用完整版本号；
+      # 安装 Cosign v3+ 必须使用 v4 及以后的 installer，v3 系列只能安装 Cosign 2.x。
+      uses: sigstore/cosign-installer@v4.1.2
 
     - name: Login to Registry
       if: github.event_name == 'push'
@@ -481,7 +483,7 @@ jobs:
         output-file: sbom-cyclonedx.json
 
     - name: Upload SBOM
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: sbom
         path: sbom-cyclonedx.json
diff --git a/21_case_devops/21.2_github_actions.md b/21_case_devops/21.2_github_actions.md
index bf4625c..dad8736 100644
--- a/21_case_devops/21.2_github_actions.md
+++ b/21_case_devops/21.2_github_actions.md
@@ -24,7 +24,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: docker/setup-buildx-action@v4
       - uses: docker/build-push-action@v7
         with:
@@ -105,7 +105,7 @@ jobs:
   build-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: docker/login-action@v4
         with:
diff --git a/21_case_devops/README.md b/21_case_devops/README.md
index df8b115..810618e 100644
--- a/21_case_devops/README.md
+++ b/21_case_devops/README.md
@@ -4,7 +4,7 @@
 
 本章示例中使用的镜像版本遵循以下原则：
 
-- **GitHub Actions** (`actions/checkout@v6` 等) 采用大版本标签，代表最新的功能版本与稳定性的平衡
+- **GitHub Actions** (`actions/checkout@v7` 等) 采用大版本标签，代表最新的功能版本与稳定性的平衡
 - **编程语言镜像** (`golang:1.26-alpine`、`rust:1.95-alpine` 等) 采用次版本标签，确保 API 稳定性同时获得安全更新
 - **数据库镜像** (`postgres:16-alpine`、`redis:8-alpine` 等) 采用大版本标签，便于获得修复和改进
 - **基础镜像** (`alpine:3.21`、`debian:12` 等) 采用大版本或次版本标签，避免 `latest` 以确保可再现性