diff --git a/.github/workflows/_nox.yml b/.github/workflows/_nox.yml
index 04f8dac8d0..0db579c1bd 100644
--- a/.github/workflows/_nox.yml
+++ b/.github/workflows/_nox.yml
@@ -119,7 +119,7 @@ jobs:
         with:
           python-version: ${{ matrix.leg.python }}
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "latest"
           enable-cache: true
diff --git a/.github/workflows/benchmarks_main.yml b/.github/workflows/benchmarks_main.yml
index 0d50fda2b6..0d019950f1 100644
--- a/.github/workflows/benchmarks_main.yml
+++ b/.github/workflows/benchmarks_main.yml
@@ -82,7 +82,7 @@ jobs:
       - name: Push benchmark image
         run: docker push "$BENCHER_REGISTRY/$BENCHER_PROJECT:$IMAGE_TAG"
 
-      - uses: bencherdev/bencher@4c83b25441d145ee273adaf74be30f2382e6ba85 # v0.6.11
+      - uses: bencherdev/bencher@8d75325c3bc59403a2186a056b472c4f49d42838 # v0.6.12
 
       - name: Track main branch benchmarks with Bencher
         env:
diff --git a/.github/workflows/benchmarks_pr.yml b/.github/workflows/benchmarks_pr.yml
index 21d0138f50..5396a3d473 100644
--- a/.github/workflows/benchmarks_pr.yml
+++ b/.github/workflows/benchmarks_pr.yml
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/benchmarks_track.yml b/.github/workflows/benchmarks_track.yml
index 258d50d5f2..8d370f3b73 100644
--- a/.github/workflows/benchmarks_track.yml
+++ b/.github/workflows/benchmarks_track.yml
@@ -99,7 +99,7 @@ jobs:
         if: steps.artifact.outputs.found == 'true'
         run: docker push "$BENCHER_REGISTRY/$BENCHER_PROJECT:pr-$PR_HEAD_SHA"
 
-      - uses: bencherdev/bencher@4c83b25441d145ee273adaf74be30f2382e6ba85 # v0.6.11
+      - uses: bencherdev/bencher@8d75325c3bc59403a2186a056b472c4f49d42838 # v0.6.12
         if: steps.artifact.outputs.found == 'true'
 
       # --start-point-* rebases the PR branch onto its base every run, so the
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 4936e51396..ee33d3826f 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -29,7 +29,7 @@ jobs:
 
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           cache-binary: false
       - name: Login to Docker Hub
diff --git a/.github/workflows/run_periodic_tests.yml b/.github/workflows/run_periodic_tests.yml
index f71a27214b..feb1383ae5 100644
--- a/.github/workflows/run_periodic_tests.yml
+++ b/.github/workflows/run_periodic_tests.yml
@@ -91,7 +91,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "latest"
           enable-cache: true
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 94743a93e1..568412ec6e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -65,6 +65,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v3.29.5
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/test_on_push.yml b/.github/workflows/test_on_push.yml
index 7dcc6fb8d2..9f66902efe 100644
--- a/.github/workflows/test_on_push.yml
+++ b/.github/workflows/test_on_push.yml
@@ -102,7 +102,7 @@ jobs:
         with:
           python-version: 3.12
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "latest"
           enable-cache: true
@@ -225,7 +225,7 @@ jobs:
         with:
           python-version: 3.13
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "latest"
           enable-cache: true