diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 51cdbc43e..bb83a95db 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -16,15 +16,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.4.1
+        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v2.1.0
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -32,7 +32,7 @@ jobs:
 
       - name: dev-env container metadata
         id: meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -40,7 +40,7 @@ jobs:
 
       - name: build-cache container metadata
         id: build_cache_meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -48,7 +48,7 @@ jobs:
 
       - name: Build and push
         id: docker_build
-        uses: docker/build-push-action@v4.0.0
+        uses: docker/build-push-action@v5
         with:
           target: test
           pull: true
@@ -70,7 +70,7 @@ jobs:
       # arguments, but that isn't currently supported:
       # https://github.com/moby/buildkit/issues/2818
       - name: Push recent test cache
-        uses: docker/build-push-action@v4.0.0
+        uses: docker/build-push-action@v5
         with:
           target: test
           tags: ${{ steps.meta.outputs.tags }}
@@ -83,15 +83,15 @@ jobs:
     needs: [build]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.4.1
+        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v2.1.0
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -99,14 +99,14 @@ jobs:
 
       - name: build-cache container metadata
         id: build_cache_meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
             suffix=-build-cache-test
 
       - name: Push recent runtime cache
-        uses: docker/build-push-action@v4.0.0
+        uses: docker/build-push-action@v5
         with:
           target: runtime
           tags: ${{ steps.meta.outputs.tags }}
@@ -119,11 +119,11 @@ jobs:
     needs: [build]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: dev-env container metadata
         id: meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -173,11 +173,11 @@ jobs:
         ci_node_total: [6]
         ci_node_index: [0, 1, 2, 3, 4, 5]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: dev-env container metadata
         id: meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -215,7 +215,7 @@ jobs:
 
       - name: Dump docker logs
         if: ${{ always() }}
-        uses: jwalton/gh-docker-logs@v2.2.1
+        uses: jwalton/gh-docker-logs@v2
         with:
           dest: test/tmp/artifacts/docker-logs
 
@@ -255,11 +255,11 @@ jobs:
           --health-timeout 90s
           --health-retries 5
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: dev-env container metadata
         id: meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -294,7 +294,7 @@ jobs:
 
       - name: Dump docker logs
         if: ${{ always() }}
-        uses: jwalton/gh-docker-logs@v2.2.1
+        uses: jwalton/gh-docker-logs@v2
         with:
           dest: test/tmp/artifacts/docker-logs
 
@@ -334,11 +334,11 @@ jobs:
           --health-timeout 90s
           --health-retries 5
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: dev-env container metadata
         id: meta
-        uses: docker/metadata-action@v4.3.0
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -374,7 +374,7 @@ jobs:
 
       - name: Dump docker logs
         if: ${{ always() }}
-        uses: jwalton/gh-docker-logs@v2.2.1
+        uses: jwalton/gh-docker-logs@v2
         with:
           dest: test/tmp/artifacts/docker-logs
 
@@ -405,7 +405,7 @@ jobs:
           path: ./artifacts
 
       - name: Publish Unit Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2.3.0
+        uses: EnricoMi/publish-unit-test-result-action@v2
         with:
           junit_files: "artifacts/*/reports/**/*.xml"
           comment_mode: off
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94c0f8122..6d22f3f01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,10 +14,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.4.1
+        uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
 
@@ -31,28 +31,46 @@ jobs:
           fi
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v2.1.0
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Container metadata
-        id: meta
-        uses: docker/metadata-action@v4.3.0
+      - name: Runtime container metadata
+        id: runtime_meta
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=semver,pattern={{version}}
 
-      - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v4.0.0
+      - name: Runtime egress container metadata
+        id: runtime_egress_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,prefix=egress-,pattern={{version}}
+
+      - name: Build and push runtime
+        uses: docker/build-push-action@v5
         with:
           target: runtime
           pull: true
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.runtime_meta.outputs.tags }}
+          labels: ${{ steps.runtime_meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-cache-runtime-recent,mode=max
+          provenance: false
+
+      - name: Build and push runtime-egress
+        uses: docker/build-push-action@v5
+        with:
+          target: runtime-egress
+          pull: true
+          push: true
+          tags: ${{ steps.runtime_egress_meta.outputs.tags }}
+          labels: ${{ steps.runtime_egress_meta.outputs.labels }}
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-cache-runtime-recent,mode=max
           provenance: false