diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index 1d5009cc..b27d5e01 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -14,18 +14,18 @@ jobs:
       matrix:
         spec:
           - { name: 'linux x86_64', runner: ubuntu-20.04, target: manylinux_2_27_x86_64 }
-          - { name: 'macOS x86_64', runner: macos-11, target: macosx_10_14_x86_64 }
+          - { name: 'macOS x86_64', runner: macos-12, target: macosx_10_14_x86_64 }
           - { name: 'Windows x86_64', runner: windows-2019, target: win_amd64 }
     name: building ${{ matrix.spec.name }}
     runs-on: ${{ matrix.spec.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
@@ -39,10 +39,10 @@ jobs:
         run: |
           python setup.py sdist
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: startsWith(matrix.spec.name, 'linux')
         with:
-          name: zrok_sdk
+          name: zrok_sdk_${{ matrix.spec.target }}
           path: ${{ github.workspace }}/sdk/python/sdk/zrok/dist/*
 
   publish:
@@ -52,15 +52,17 @@ jobs:
           id-token: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          path: download
+          path: ./download
+          merge-multiple: true
+          pattern: zrok_sdk_*
 
       - name: check
         run: |
-          ls -lR download
+          ls -lR ./download/
           mkdir dist
-          cp download/*/* dist
+          cp ./download/* ./dist/
 
       - name: Publish wheels (TestPYPI)
         uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index 18fe8e36..9f1569a1 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -19,15 +19,15 @@ jobs:
     name: Build Linux AMD64 CLI
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: setup-go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
 
       - name: setup-node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -72,7 +72,7 @@ jobs:
           echo go_bin="$(go env GOPATH)/bin" >> $GITHUB_OUTPUT
 
       - name: upload build artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: linux-amd64
           path: ${{ steps.solve_go_bin.outputs.go_bin }}/zrok
@@ -92,25 +92,25 @@ jobs:
           echo branch_tag=$(sed 's/[^a-z0-9_-]/__/gi' <<< "${GITHUB_REF#refs/heads/}") >> $GITHUB_OUTPUT
 
       - name: Checkout Workspace
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Download Branch Build Artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: linux-amd64
           path: ./dist/amd64/linux/
 
       - name: Set Up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: amd64,arm64
 
       - name: Set Up Docker BuildKit
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKER_HUB_API_USER || secrets.DOCKER_HUB_API_USER }}
           password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
diff --git a/.github/workflows/deploy-doc-site.yml b/.github/workflows/deploy-doc-site.yml
index 7b0d81cd..a97d37c9 100644
--- a/.github/workflows/deploy-doc-site.yml
+++ b/.github/workflows/deploy-doc-site.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
           
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         name: setup npm
         with:
           node-version: 18
diff --git a/.github/workflows/node-sdk.yml b/.github/workflows/node-sdk.yml
index 064063a7..ae1b9254 100644
--- a/.github/workflows/node-sdk.yml
+++ b/.github/workflows/node-sdk.yml
@@ -38,7 +38,7 @@ jobs:
 
     - name: Get current zrok repo tag
       id: tag
-      run: echo ::set-output name=TAG::$(git describe --tags --abbrev=0)
+      run: echo "TAG=$(git describe --tags --abbrev=0)" | tee -a $GITHUB_OUTPUT
 
     - name: Update zrok NodeJS-SDK's package.json version based on current zrok repo git tag
       if: github.ref_type == 'tag'
@@ -49,7 +49,7 @@ jobs:
     - name: Setup .npmrc
       if: github.ref_type == 'tag'
       # Setup .npmrc file to prepare for possible publish to npm
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
         registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/publish-docker-images.yml b/.github/workflows/publish-docker-images.yml
index 4471dcf0..937c2884 100644
--- a/.github/workflows/publish-docker-images.yml
+++ b/.github/workflows/publish-docker-images.yml
@@ -27,7 +27,7 @@ jobs:
           echo "zrok_semver=${zrok_semver#v}" | tee -a $GITHUB_OUTPUT
 
       - name: Checkout Workspace
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Create the Release Arch Dirs
         run: |
@@ -36,36 +36,38 @@ jobs:
           done
 
       - name: Download Linux AMD64 Release Artifact
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@1.1.2
         with:
           version: tags/v${{ steps.semver.outputs.zrok_semver }}
-          file: zrok_${{ steps.semver.outputs.zrok_semver }}_linux_amd64.tar.gz
-          target: dist/amd64/linux/zrok_${{ steps.semver.outputs.zrok_semver }}_linux_amd64.tar.gz
+          file: zrok.*_linux_amd64.tar.gz
+          regex: true
+          target: dist/amd64/linux/zrok_linux_amd64.tar.gz
 
       - name: Download Linux ARM64 Release Artifact
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@1.1.2
         with:
           version: tags/v${{ steps.semver.outputs.zrok_semver }}
-          file: zrok_${{ steps.semver.outputs.zrok_semver }}_linux_arm64.tar.gz
-          target: dist/arm64/linux/zrok_${{ steps.semver.outputs.zrok_semver }}_linux_arm64.tar.gz
+          file: zrok.*_linux_arm64.tar.gz
+          regex: true
+          target: dist/arm64/linux/zrok_linux_arm64.tar.gz
 
       - name: Unpack the Release Artifacts
         run: |
           for TGZ in dist/{amd,arm}64/linux; do
-            tar -xvzf ${TGZ}/zrok_*.tar.gz -C ${TGZ}
+            tar -xvzf ${TGZ}/*.tar.gz -C ${TGZ}
           done
 
       - name: Set Up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: amd64,arm64
 
       - name: Set Up Docker BuildKit
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKER_HUB_API_USER || secrets.DOCKER_HUB_API_USER }}
           password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
@@ -76,8 +78,9 @@ jobs:
           ZROK_CONTAINER_IMAGE_TAG: ${{ steps.semver.outputs.zrok_semver }}
         id: tagprep_cli
         run: |
-          echo DOCKER_TAGS="${ZROK_CONTAINER_IMAGE_REPO}:${ZROK_CONTAINER_IMAGE_TAG},${ZROK_CONTAINER_IMAGE_REPO}:latest" \
-          | tee -a $GITHUB_OUTPUT
+          DOCKER_TAGS="${ZROK_CONTAINER_IMAGE_REPO}:${ZROK_CONTAINER_IMAGE_TAG}"
+          DOCKER_TAGS+=",${ZROK_CONTAINER_IMAGE_REPO}:latest"
+          echo "DOCKER_TAGS=${DOCKER_TAGS}" | tee -a $GITHUB_OUTPUT
 
       # this is the CLI image with the Linux binary for each
       # arch that was downloaded in ./dist/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6900a13b..ba86e0b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,18 +21,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-multilib g++-multilib
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -44,21 +44,21 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v5
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-linux.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-linux-amd64
           path: ./dist/*.gz
 
       - name: Configure jFrog CLI
-        uses: jfrog/setup-jfrog-cli@v3
+        uses: jfrog/setup-jfrog-cli@v4
         with:
           version: ${{ env.JFROG_CLI_VERSION }}
         env:
@@ -91,18 +91,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-aarch64-linux-gnu
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -114,21 +114,21 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-linux-arm64.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-linux-arm64
           path: ./dist/*.gz
 
       - name: Configure jFrog CLI
-        uses: jfrog/setup-jfrog-cli@v3
+        uses: jfrog/setup-jfrog-cli@v4
         with:
           version: ${{ env.JFROG_CLI_VERSION }}
         env:
@@ -161,18 +161,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-arm-linux-gnueabi
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -184,21 +184,21 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-linux-armhf.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-linux-arm
           path: ./dist/*.gz
 
       - name: Configure jFrog CLI
-        uses: jfrog/setup-jfrog-cli@v3
+        uses: jfrog/setup-jfrog-cli@v4
         with:
           version: ${{ env.JFROG_CLI_VERSION }}
         env:
@@ -235,18 +235,18 @@ jobs:
           p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
           p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -258,19 +258,19 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-darwin.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           AC_USERNAME: ${{ secrets.AC_USERNAME }}
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-darwin
           path: ./dist/*.gz
 
   build-windows:
@@ -280,18 +280,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-mingw-w64-x86-64
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -303,48 +303,56 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-windows.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-windows
           path: ./dist/*.gz
 
   publish-release:
     # allow skipped but not failed
     if: ${{
           !cancelled()
-          && (needs.build-linux-amd64.result == 'success' || needs.build-linux-amd64.result == 'skipped')
-          && (needs.build-linux-arm.result   == 'success' || needs.build-linux-amd.result   == 'skipped')
-          && (needs.build-linux-arm64.result == 'success' || needs.build-linux-amd64.result == 'skipped')
+          && (needs.build-linux-amd64.result == 'success')
+          && (needs.build-linux-arm.result   == 'success')
+          && (needs.build-linux-arm64.result == 'success')
           && (needs.build-darwin.result      == 'success' || needs.build-darwin.result      == 'skipped')
           && (needs.build-windows.result     == 'success' || needs.build-windows.result     == 'skipped')
       }}
-    needs: [build-linux-amd64, build-linux-arm, build-linux-arm64, build-darwin, build-windows]
+    needs:
+      - build-linux-amd64
+      - build-linux-arm
+      - build-linux-arm64
+      - build-darwin
+      - build-windows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - run: |
           mkdir -p ./automated-release-build
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: ./automated-release-build
+          merge-multiple: true
+          pattern: release-builds-*
 
       - run: |
-          mv ./automated-release-build/release-builds/* ./automated-release-build/
-          rm -rf ./automated-release-build/release-builds
+          ls -lAR ./automated-release-build/
           shasum ./automated-release-build/* > ./automated-release-build/checksums.txt
 
-      - uses: goreleaser/goreleaser-action@v3
+      - uses: goreleaser/goreleaser-action@v6
         with:
+          distribution: goreleaser
+          version: '~> v2'
           args: release --config .goreleaser-release.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c08e38ea..ca3dca42 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,13 @@
 
 ## v0.4.34
 
+FEATURE: Linux service support for all private share modes (contribution from Stefan Adelbert @stefanadelbert)
+
 FIX: Fix for mixing limited and unlimited (-1) resource counts in the limits system (https://github.com/openziti/zrok/issues/680)
 
-FEATURE: Linux service support for all private share modes (contribution from Stefan Adelbert @stefanadelbert)
+CHANGE: bump many GitHub Actions that were using deprecated distributions of Node.js
+
+CHANGE: bump macOS runner for Node SDK from macos-11 to macos-12
 
 ## v0.4.33