diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4964b33..7d2e3f2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,10 +32,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
 
       - name: Sanity-check that the tag matches pyproject.toml's version
         # `git tag v0.2.0` while pyproject.toml still says 0.1.0 produces
@@ -54,7 +54,7 @@ jobs:
         run: uv build
 
       - name: Upload built artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4  # v5.0.0
         with:
           name: dist
           path: dist/
@@ -77,7 +77,7 @@ jobs:
       contents: read
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0  # v5.0.0
         with:
           name: dist
           path: dist/
@@ -87,4 +87,4 @@ jobs:
         # the OIDC exchange automatically when the project is configured
         # on PyPI's side. If publishing breaks with "Invalid token", the
         # PyPI Trusted Publisher config doesn't match this workflow.
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index 3877a3f..b450a85 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -18,10 +18,10 @@ jobs:
       run:
         working-directory: bcli-site
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index aa48b67..dee12b3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -29,10 +29,10 @@ jobs:
       # so a maintainer can audit the version without resolving SHAs.
       # Bumping requires checking the new SHA against the upstream
       # release notes and updating both fields together.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}