diff --git a/act/jobparser/evaluator.go b/act/jobparser/evaluator.go
index ac05cfe0..a452dd2a 100644
--- a/act/jobparser/evaluator.go
+++ b/act/jobparser/evaluator.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 
 	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // ExpressionEvaluator is copied from runner.expressionEvaluator,
diff --git a/act/jobparser/interpeter.go b/act/jobparser/interpeter.go
index d4d92bfb..4de4cd64 100644
--- a/act/jobparser/interpeter.go
+++ b/act/jobparser/interpeter.go
@@ -3,7 +3,7 @@ package jobparser
 import (
 	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
 	"code.forgejo.org/forgejo/runner/v9/act/model"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // NewInterpeter returns an interpeter used in the server,
diff --git a/act/jobparser/jobparser.go b/act/jobparser/jobparser.go
index 00dec363..1329a818 100644
--- a/act/jobparser/jobparser.go
+++ b/act/jobparser/jobparser.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"code.forgejo.org/forgejo/runner/v9/act/model"
 )
diff --git a/act/jobparser/jobparser_test.go b/act/jobparser/jobparser_test.go
index 0386bcb9..4ae0a190 100644
--- a/act/jobparser/jobparser_test.go
+++ b/act/jobparser/jobparser_test.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestParse(t *testing.T) {
diff --git a/act/jobparser/model.go b/act/jobparser/model.go
index dd446596..4d3f8d42 100644
--- a/act/jobparser/model.go
+++ b/act/jobparser/model.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"code.forgejo.org/forgejo/runner/v9/act/model"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // SingleWorkflow is a workflow with single job and single matrix
diff --git a/act/jobparser/model_test.go b/act/jobparser/model_test.go
index 684701c4..1edaf4a5 100644
--- a/act/jobparser/model_test.go
+++ b/act/jobparser/model_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestParseRawOn(t *testing.T) {
diff --git a/act/model/action.go b/act/model/action.go
index 50bbc905..6f2354f6 100644
--- a/act/model/action.go
+++ b/act/model/action.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 
 	"code.forgejo.org/forgejo/runner/v9/act/schema"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // ActionRunsUsing is the type of runner for the action
diff --git a/act/model/workflow.go b/act/model/workflow.go
index a9a2d32b..12bba60b 100644
--- a/act/model/workflow.go
+++ b/act/model/workflow.go
@@ -16,7 +16,7 @@ import (
 	"code.forgejo.org/forgejo/runner/v9/act/common"
 	"code.forgejo.org/forgejo/runner/v9/act/schema"
 	log "github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // Workflow is the structure of the files in .github/workflows
diff --git a/act/runner/expression.go b/act/runner/expression.go
index 1c52a424..11791ef4 100644
--- a/act/runner/expression.go
+++ b/act/runner/expression.go
@@ -17,7 +17,7 @@ import (
 	"code.forgejo.org/forgejo/runner/v9/act/container"
 	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
 	"code.forgejo.org/forgejo/runner/v9/act/model"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // ExpressionEvaluator is the interface for evaluating expressions
diff --git a/act/runner/expression_test.go b/act/runner/expression_test.go
index 38959288..00cbc603 100644
--- a/act/runner/expression_test.go
+++ b/act/runner/expression_test.go
@@ -6,7 +6,7 @@ import (
 	"code.forgejo.org/forgejo/runner/v9/act/exprparser"
 	"code.forgejo.org/forgejo/runner/v9/act/model"
 	assert "github.com/stretchr/testify/assert"
-	yaml "gopkg.in/yaml.v3"
+	yaml "go.yaml.in/yaml/v3"
 )
 
 func createRunContext(t *testing.T) *RunContext {
diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go
index c8e030d6..7d865777 100644
--- a/act/runner/run_context_test.go
+++ b/act/runner/run_context_test.go
@@ -22,7 +22,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	yaml "gopkg.in/yaml.v3"
+	yaml "go.yaml.in/yaml/v3"
 )
 
 func TestRunContext_EvalBool(t *testing.T) {
diff --git a/act/runner/runner_test.go b/act/runner/runner_test.go
index cee533e3..83523c1e 100644
--- a/act/runner/runner_test.go
+++ b/act/runner/runner_test.go
@@ -16,7 +16,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	assert "github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"code.forgejo.org/forgejo/runner/v9/act/common"
 	"code.forgejo.org/forgejo/runner/v9/act/model"
diff --git a/act/runner/step_action_local_test.go b/act/runner/step_action_local_test.go
index f6e0a361..d9bfdd3f 100644
--- a/act/runner/step_action_local_test.go
+++ b/act/runner/step_action_local_test.go
@@ -12,7 +12,7 @@ import (
 	"code.forgejo.org/forgejo/runner/v9/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 type stepActionLocalMocks struct {
diff --git a/act/runner/step_action_remote_test.go b/act/runner/step_action_remote_test.go
index 5287f380..6c1a4db7 100644
--- a/act/runner/step_action_remote_test.go
+++ b/act/runner/step_action_remote_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"code.forgejo.org/forgejo/runner/v9/act/common"
 	"code.forgejo.org/forgejo/runner/v9/act/common/git"
diff --git a/act/runner/step_test.go b/act/runner/step_test.go
index b69c08aa..74b83c6c 100644
--- a/act/runner/step_test.go
+++ b/act/runner/step_test.go
@@ -9,7 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
-	yaml "gopkg.in/yaml.v3"
+	yaml "go.yaml.in/yaml/v3"
 )
 
 func TestStep_MergeIntoMap(t *testing.T) {
diff --git a/act/schema/schema.go b/act/schema/schema.go
index c2de3e59..cbb51283 100644
--- a/act/schema/schema.go
+++ b/act/schema/schema.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 
 	"github.com/rhysd/actionlint"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 //go:embed workflow_schema.json
diff --git a/act/schema/schema_test.go b/act/schema/schema_test.go
index d7bc383f..fe2598f2 100644
--- a/act/schema/schema_test.go
+++ b/act/schema/schema_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestAdditionalFunctions(t *testing.T) {
diff --git a/go.mod b/go.mod
index a25bc8b9..92bb4f1b 100644
--- a/go.mod
+++ b/go.mod
@@ -36,10 +36,10 @@ require (
 	github.com/stretchr/testify v1.10.0
 	github.com/timshannon/bolthold v0.0.0-20240314194003-30aac6950928
 	go.etcd.io/bbolt v1.4.2
+	go.yaml.in/yaml/v3 v3.0.4
 	golang.org/x/term v0.34.0
 	golang.org/x/time v0.12.0
 	google.golang.org/protobuf v1.36.7
-	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
 
@@ -105,4 +105,5 @@ require (
 	golang.org/x/sys v0.35.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index e6ca818e..2ac739de 100644
--- a/go.sum
+++ b/go.sum
@@ -226,6 +226,8 @@ go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKr
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
diff --git a/internal/app/cmd/create-runner-file_test.go b/internal/app/cmd/create-runner-file_test.go
index d12cc325..cd0a720e 100644
--- a/internal/app/cmd/create-runner-file_test.go
+++ b/internal/app/cmd/create-runner-file_test.go
@@ -14,7 +14,7 @@ import (
 	"connectrpc.com/connect"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func Test_createRunnerFileCmd(t *testing.T) {
diff --git a/internal/app/run/workflow.go b/internal/app/run/workflow.go
index 601f36d1..2a0b3a0c 100644
--- a/internal/app/run/workflow.go
+++ b/internal/app/run/workflow.go
@@ -11,7 +11,7 @@ import (
 
 	runnerv1 "code.forgejo.org/forgejo/actions-proto/runner/v1"
 	"code.forgejo.org/forgejo/runner/v9/act/model"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func generateWorkflow(task *runnerv1.Task) (*model.Workflow, string, error) {
diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go
index 69d9f482..3390e91c 100644
--- a/internal/pkg/config/config.go
+++ b/internal/pkg/config/config.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/joho/godotenv"
 	log "github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // Log represents the configuration for logging.