diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 685156837..efb9fc13d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -119,7 +119,7 @@ jobs:
           uv pip install dist/*.whl
         shell: bash
       - name: Upload wheels as artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: python-packages-${{ runner.os }}
           path: |
@@ -137,13 +137,13 @@ jobs:
           SPHINX_IMMATERIAL_EXTERNAL_RESOURCE_CACHE_DIR: ${{ github.workspace }}/theme_build_cache
         run: uvx nox -s docs --forcecolor
       - name: Upload doc builds as artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: doc-builds-${{ runner.os }}
           path: docs/_build/
       - name: upload docs to github pages
         if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' && runner.os == 'Linux'
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # pinned to v4.0.0
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # pinned to v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/_build/html
@@ -203,7 +203,7 @@ jobs:
         # `coverage run` cmd adds the working dir to python path, so no need to install pkg here
         run: uvx nox -s tests --forcecolor --python ${{ matrix.python-version }}
       - name: Upload coverage data
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-data-${{ runner.os }}-py${{ matrix.python-version }}
           path: .coverage*
@@ -217,7 +217,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Download all artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           merge-multiple: true
           pattern: coverage-data-*
@@ -232,7 +232,7 @@ jobs:
         run: uvx nox -s coverage
       - name: Post coverage summary
         if: github.repository == 'jbms/sphinx-immaterial'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         env:
           CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}}
         with:
@@ -245,17 +245,17 @@ jobs:
     needs: [build]
     steps:
       - name: Download Linux package
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: python-packages-Linux
           path: dist-Linux
       - name: Download macOS package
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: python-packages-macOS
           path: dist-macOS
       - name: Download Windows package
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: python-packages-Windows
           path: dist-Windows
@@ -275,12 +275,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, test]
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: python-packages-Linux
           path: dist
       - name: Publish to PyPI (test server)
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         continue-on-error: true
         with:
           user: __token__
@@ -288,7 +288,7 @@ jobs:
           repository-url: https://test.pypi.org/legacy/
         if: ${{ ! startsWith(github.ref, 'refs/tags/v') }}
       - name: Publish to PyPI (main server)
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           user: __token__
           password: ${{ secrets.pypi_token }}