diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c14e9bb..eb33a64 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -63,4 +63,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml
index 9a33440..8d070bb 100644
--- a/.github/workflows/flake-update.yml
+++ b/.github/workflows/flake-update.yml
@@ -37,7 +37,7 @@ jobs:
       # or closing and reopening the PR; swap in a PAT via `token:` if
       # self-triggering CI is required.
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28
+        uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3 # v29
         with:
           pr-title: "chore: update flake.lock"
           commit-msg: "chore: update flake.lock"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a06136..816a322 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -75,6 +75,6 @@ jobs:
       # resolved yourself:
       #   gh api repos/softprops/action-gh-release/git/ref/tags/v3 --jq .object.sha
       - name: Create draft release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           draft: true