diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d344493..74185b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -86,7 +86,7 @@ jobs:
       - name: Check nix/deps.nix and the package version against the manifests
         run: ./scripts/verify-nix-deps.sh
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       # nix/deps.nix is the offline package cache for the Nix build, mirroring
       # the Zig manifests by hand. Nothing built it in CI, so it silently went
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cf9b5d4..3949e71 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -140,7 +140,7 @@ jobs:
           pattern: wisp-*
 
       - name: Create Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: artifacts/**/*
           generate_release_notes: true