diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index 0796d98e..4392fd1a 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Enable auto-merge for Dependabot PRs
diff --git a/.github/workflows/build-docs.yaml b/.github/workflows/build-docs.yaml
index 86a42282..3ab78409 100644
--- a/.github/workflows/build-docs.yaml
+++ b/.github/workflows/build-docs.yaml
@@ -33,6 +33,6 @@ jobs:
           rats-ci install
           rats-docs build
       - name: "upload-gh-pages"
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: "rats-devtools/dist/site"
diff --git a/.github/workflows/build-wheels.yaml b/.github/workflows/build-wheels.yaml
index d6a78783..180225a6 100644
--- a/.github/workflows/build-wheels.yaml
+++ b/.github/workflows/build-wheels.yaml
@@ -45,7 +45,7 @@ jobs:
         with:
           subject-path: "${{ matrix.component }}/dist/*"
       - name: "upload-artifacts"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "wheels.${{ matrix.component }}"
           path: "${{ matrix.component }}/dist/*.whl"
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index a044deda..a24d67b5 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -42,7 +42,7 @@ jobs:
           uv version "$PACKAGE_VERSION"
           rats-ci install check test
       - name: upload-coverage
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: microsoft/rats
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8ff79974..710fb8f8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -33,7 +33,7 @@ jobs:
       id-token: write
     steps:
       - name: download-wheels
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: "wheels.${{ matrix.component }}"
           path: dist/
@@ -57,4 +57,4 @@ jobs:
     steps:
       - name: "deploy-gh-pages"
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0