diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index e1ccf5d..86a63bf 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -15,12 +15,12 @@ jobs:
         python-version: ["3.14"]
 
     steps:
-      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"  # v7.0.0
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Set up Python ${{ matrix.python-version }}"
-        uses: "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1"  # v6
+        uses: "actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97"  # v7.0.0
         with:
           python-version: "${{ matrix.python-version }}"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8285993..87f6918 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,12 +11,12 @@ jobs:
   build:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"  # v7.0.0
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Set up Python"
-        uses: "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1"  # v6
+        uses: "actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97"  # v7.0.0
         with:
           python-version: "3.12"
 
@@ -48,4 +48,4 @@ jobs:
           path: "dist/"
 
       - name: "Upload dist to PyPI"
-        uses: "pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b" # release/v1
+        uses: "pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247" # v1.14.1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7b10a4e..d696778 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,12 +21,12 @@ jobs:
           - "PySide"
 
     steps:
-      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"  # v7.0.0
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Set up Python ${{ matrix.python-version }}"
-        uses: "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1"  # v6
+        uses: "actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97"  # v7.0.0
         with:
           python-version: "${{ matrix.python-version }}"
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 02bb4b1..9dca9a9 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -21,9 +21,9 @@ jobs:
       security-events: "write" # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
       - name: "Checkout repository"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run zizmor 🌈"
-        uses: "zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa" # v0.5.7
+        uses: "zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5" # v0.6.1