diff --git a/.github/workflows/build-sphinx-docs.yaml b/.github/workflows/build-sphinx-docs.yaml
index 09e7bfc..a0910dc 100644
--- a/.github/workflows/build-sphinx-docs.yaml
+++ b/.github/workflows/build-sphinx-docs.yaml
@@ -59,12 +59,12 @@ jobs:
       BUILD_DIR: ${{ inputs.build-directory }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: '3.12'
           cache: 'pip'
diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml
index 68493c6..c849fba 100644
--- a/.github/workflows/cla-check.yaml
+++ b/.github/workflows/cla-check.yaml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout Base Branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -74,7 +74,7 @@ jobs:
           fi
 
       - name: Checkout PR Branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           persist-credentials: false
@@ -123,7 +123,7 @@ jobs:
       - name: Checkout Merge Branch
         if: env.merge_ref_defined == 'true'
         id: checkout_merge
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         continue-on-error: true
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/fortran-lint.yaml b/.github/workflows/fortran-lint.yaml
index 008e4ad..341fdc5 100644
--- a/.github/workflows/fortran-lint.yaml
+++ b/.github/workflows/fortran-lint.yaml
@@ -84,12 +84,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup uv and Python ${{ env.UV_PYTHON }}
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # 8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
         with:
           python-version: ${{ env.UV_PYTHON }}
           enable-cache: ${{ inputs.enable-cache }}
diff --git a/.github/workflows/sphinx-docs.yaml b/.github/workflows/sphinx-docs.yaml
index c3ed2f5..39e7e5e 100644
--- a/.github/workflows/sphinx-docs.yaml
+++ b/.github/workflows/sphinx-docs.yaml
@@ -126,7 +126,7 @@ jobs:
         run: echo "SPHINX_DEBUG=-v --show-traceback" >> "$GITHUB_ENV"
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -205,7 +205,7 @@ jobs:
 
       - name: Cache virtual environment
         id: cache-venv
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5.1.0
         with:
           path: ${{ env.VENV_PATH }}
           key: ${{ runner.os }}-${{ env.PYTHON_VRSN }}-${{ hashFiles('pyproject.toml', format('{0}/pyproject.toml', inputs.docs-dir), format('{0}/pyproject.toml', inputs.source-dir), format('{0}/conf.py', inputs.source-dir)) }}
diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml
index fe0a316..6128754 100644
--- a/.github/workflows/track-review-project.yaml
+++ b/.github/workflows/track-review-project.yaml
@@ -48,7 +48,7 @@ jobs:
     steps:
       # Required as running from the workflow_run trigger
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/umdp3_fixer.yaml b/.github/workflows/umdp3_fixer.yaml
index 85414e9..1f884ea 100644
--- a/.github/workflows/umdp3_fixer.yaml
+++ b/.github/workflows/umdp3_fixer.yaml
@@ -31,14 +31,14 @@ jobs:
 
     steps:
       - name: Checkout Branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: pr_branch
           token: ${{ secrets.GITHUB_TOKEN }}
           persist-credentials: false
 
       - name: Checkout SimSys_Scripts
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: MetOffice/SimSys_Scripts
           sparse-checkout: umdp3_fixer
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python 3.14
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: 3.14
 
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 7ea8679..d6d199e 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -30,18 +30,18 @@ jobs:
       UV_PYTHON: "3.14"
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
         with:
           python-version: ${{ env.UV_PYTHON }}
           enable-cache: true
 
       - name: Restore uv cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25  # v5.1.0
         with:
           path: ${{ env.UV_CACHE_DIR }}
           key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
diff --git a/.github/workflows/validate_symlinks.yaml b/.github/workflows/validate_symlinks.yaml
index c478a5b..b04d836 100644
--- a/.github/workflows/validate_symlinks.yaml
+++ b/.github/workflows/validate_symlinks.yaml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout Branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           persist-credentials: false