diff --git a/.github/workflows/_cache_docker.yml b/.github/workflows/_cache_docker.yml
index 84386d5aedfc..610b4e90d7a5 100644
--- a/.github/workflows/_cache_docker.yml
+++ b/.github/workflows/_cache_docker.yml
@@ -37,7 +37,7 @@ jobs:
   docker:
     runs-on: ubuntu-22.04
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.0.18
+    - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.2.20
       name: Prime Docker cache (${{ inputs.image_repo }}:${{ inputs.image_tag }}@sha256:${{ inputs.image_sha }})
       with:
         image_tag: "${{ inputs.image_repo }}:${{ inputs.image_tag }}@sha256:${{ inputs.image_sha }}"
diff --git a/.github/workflows/_ci.yml b/.github/workflows/_ci.yml
index b400d76a6e6e..7b9d8c075257 100644
--- a/.github/workflows/_ci.yml
+++ b/.github/workflows/_ci.yml
@@ -92,7 +92,7 @@ jobs:
     steps:
     - if: ${{ inputs.cache_build_image }}
       name: Restore Docker cache (${{ inputs.cache_build_image }})
-      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.2.20
       with:
         image_tag: ${{ inputs.cache_build_image }}
 
@@ -120,7 +120,7 @@ jobs:
       run: git config --global --add safe.directory /__w/envoy/envoy
 
     - if: ${{ inputs.diskspace_hack }}
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.20
     - run: |
         echo "disk space at beginning of build:"
         df -h
@@ -128,7 +128,7 @@ jobs:
 
     - if: ${{ inputs.run_pre }}
       name: Run pre action ${{ inputs.run_pre && format('({0})', inputs.run_pre) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.2.20
       with:
         uses: ${{ inputs.run_pre }}
         with: ${{ inputs.run_pre_with }}
@@ -152,7 +152,7 @@ jobs:
 
     - if: ${{ inputs.run_post }}
       name: Run post action ${{ inputs.run_pre && format('({0})', inputs.run_post) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.2.20
       with:
         uses: ${{ inputs.run_post }}
         with: ${{ inputs.run_post_with }}
diff --git a/.github/workflows/_stage_publish.yml b/.github/workflows/_stage_publish.yml
index 8975169caf0a..442eaadde45e 100644
--- a/.github/workflows/_stage_publish.yml
+++ b/.github/workflows/_stage_publish.yml
@@ -108,7 +108,7 @@ jobs:
     needs:
     - publish
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.0.18
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.20
       with:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: "${{ secrets.ENVOY_CI_SYNC_APP_KEY }}"
diff --git a/.github/workflows/_workflow-start.yml b/.github/workflows/_workflow-start.yml
index 0a8944c25c0e..f0a82bed5b6e 100644
--- a/.github/workflows/_workflow-start.yml
+++ b/.github/workflows/_workflow-start.yml
@@ -29,7 +29,7 @@ jobs:
 
     - if: ${{ steps.env.outputs.trusted != 'true' }}
       name: Start status check
-      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.2.20
       with:
         authToken: ${{ secrets.GITHUB_TOKEN }}
         context: ${{ inputs.workflow_name }}
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index 6f386534d1dd..c3b612307f78 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
     - name: Pre-cleanup
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.20
       with:
         to_remove: |
           /usr/local/lib/android
diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml
index 6b964d4bb147..2e055e1ef9ea 100644
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@@ -24,7 +24,7 @@ jobs:
       actions: write
       checks: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.0.18
+    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.2.20
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         azp_org: cncf
diff --git a/.github/workflows/envoy-sync.yml b/.github/workflows/envoy-sync.yml
index f01e7bb10236..0bafb05037be 100644
--- a/.github/workflows/envoy-sync.yml
+++ b/.github/workflows/envoy-sync.yml
@@ -28,7 +28,7 @@ jobs:
         - data-plane-api
         - mobile-website
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.0.18
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.20
       with:
         repository: "envoyproxy/${{ matrix.downstream }}"
         ref: main
diff --git a/.github/workflows/workflow-complete.yml b/.github/workflows/workflow-complete.yml
index a2b32c02756e..dd6b024843df 100644
--- a/.github/workflows/workflow-complete.yml
+++ b/.github/workflows/workflow-complete.yml
@@ -53,7 +53,7 @@ jobs:
         echo "state=${STATE}" >> "$GITHUB_OUTPUT"
       id: job
     - name: Complete status check
-      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.0.18
+      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.2.20
       with:
         authToken: ${{ secrets.GITHUB_TOKEN }}
         context: Verify/examples