diff --git a/.github/workflows/python-app.yaml b/.github/workflows/python-app.yaml
index 2b2b21008..6b6380675 100644
--- a/.github/workflows/python-app.yaml
+++ b/.github/workflows/python-app.yaml
@@ -274,7 +274,7 @@ jobs:
           path: ${{ format('{0}-{1}', matrix.scenario, matrix.solve-year) }}
 
       - name: Install uv and set Python version
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           python-version: "3.11"
           enable-cache: true
diff --git a/.github/workflows/workflow-quality.yaml b/.github/workflows/workflow-quality.yaml
index e3110e3ca..a848b89af 100644
--- a/.github/workflows/workflow-quality.yaml
+++ b/.github/workflows/workflow-quality.yaml
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           inputs: .github
           persona: pedantic
@@ -49,4 +49,4 @@ jobs:
       # Migrate back to rhysd/actionlint once it supports $/, if that happens,
       # or until a better supported option is available.
       - name: Run actionlint
-        uses: kjanat/actionlint@b092abdc8be085e4b367b2ab084c075f1bed0516 # v1.15.1
+        uses: kjanat/actionlint@08bb2c4f0d039744455b87aef1c647fb8b66d37b # v1.17.0