diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..15a1938
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+
+updates:
+  # Keep the versions of the third-party actions used in .github/workflows up to date.
+  # Without this they go stale silently, until the Node runtime they run on is retired and the
+  # workflows start failing on GitHub's schedule rather than on ours.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      # one PR for all of them, rather than one PR per action
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "CI"
diff --git a/.github/workflows/check_pypi_packaging.yml b/.github/workflows/check_pypi_packaging.yml
index 4241d23..2ff0ab0 100644
--- a/.github/workflows/check_pypi_packaging.yml
+++ b/.github/workflows/check_pypi_packaging.yml
@@ -8,9 +8,9 @@ jobs:
     runs-on: "ubuntu-latest"
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
       - name: Install dependencies
diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml
index c865b08..503b741 100644
--- a/.github/workflows/docs-check.yml
+++ b/.github/workflows/docs-check.yml
@@ -5,9 +5,9 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
       - name: Install Sphinx
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7108b23..de076c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,9 +29,9 @@ jobs:
             LICENSE.txt
 
       # Publish to PyPI using Trusted Publishers
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
       - name: Install dependencies
diff --git a/.github/workflows/run_unit_tests.yml b/.github/workflows/run_unit_tests.yml
index 9ff9832..117a19f 100644
--- a/.github/workflows/run_unit_tests.yml
+++ b/.github/workflows/run_unit_tests.yml
@@ -9,12 +9,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # "3.x" means the newest released Python, so the latest version is always tested even if this
+        # list is not kept up to date. setup.py requires >= 3.10.
         python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14" ]
 
     steps:
       - uses: actions/checkout@v7
       # the runner image ships only one Python on PATH; this is what actually selects the version
-      # named by the matrix (all of 3.10-3.14 are in the runner's tool cache, so it is a fast lookup)
+      # named by the matrix
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with: