diff --git a/.github/workflows/python-ci.yaml b/.github/workflows/python-ci.yaml
index 39d693c..3071f9b 100644
--- a/.github/workflows/python-ci.yaml
+++ b/.github/workflows/python-ci.yaml
@@ -25,12 +25,12 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           enable-cache: true
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version-file: "pyproject.toml"
 
diff --git a/.github/workflows/stdlib-introspect.yaml b/.github/workflows/stdlib-introspect.yaml
index 710bfb1..819dc10 100644
--- a/.github/workflows/stdlib-introspect.yaml
+++ b/.github/workflows/stdlib-introspect.yaml
@@ -46,7 +46,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
@@ -66,7 +66,7 @@ jobs:
           # The script writes the $GITHUB_STEP_SUMMARY summary and fails on a tiny dump.
           python tools/stdlib_introspect.py -o "$OUT" "${flags[@]}"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()   # upload even a gate-failed cell's dump, for debugging
         with:
           # archive: false uploads the raw .jsonl with no zip wrapper; the artifact is
@@ -88,11 +88,11 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.x"
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: stdlib_api_*_py*
           merge-multiple: true
@@ -101,7 +101,7 @@ jobs:
       - name: Merge + summarize
         run: python tools/merge_summary.py cells -o stdlib_api_union.jsonl
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           path: stdlib_api_union.jsonl
@@ -123,7 +123,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           enable-cache: true
 
@@ -134,7 +134,7 @@ jobs:
         # floating from PyPI on every nightly run; --no-dev skips the lint toolchain.
         run: uv sync --locked --no-dev
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: stdlib_api_union.jsonl
 
@@ -145,7 +145,7 @@ jobs:
           # writes the $GITHUB_STEP_SUMMARY report of what the official docs are missing.
           uv run tools/coverage_diff.py stdlib_api_union.jsonl --target-version "$TARGET_VERSION"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           path: official_docs_coverage_by_version.json
@@ -153,7 +153,7 @@ jobs:
           retention-days: 30
           if-no-files-found: warn
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           path: official_docs_gap_${{ env.TARGET_VERSION }}.jsonl