diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b50a562..e1310c9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -626,7 +626,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: "25"
@@ -1010,7 +1010,7 @@ jobs:
           cat staging/SHA256SUMS
 
       - name: Upload the staged release
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: magic-cli-remote-release-${{ github.ref_name }}
           path: staging/
@@ -1030,7 +1030,7 @@ jobs:
       contents: write
       id-token: write
       attestations: write
-    uses: maccavelli/mcplib/.github/workflows/publish-selfupdate-release.yml@8d4d89ff34ff79c1ed65f223cc3d83b3ec0550aa # mcplib v1.4.1
+    uses: maccavelli/mcplib/.github/workflows/publish-selfupdate-release.yml@4e1f9a53e265808bbfa740e3e3b09a51ed7f56ce # mcplib v1.6.0
     with:
       artifact-name: magic-cli-remote-release-${{ github.ref_name }}
       products-json: '["mcremote","mcrelay"]'