diff --git a/.github/workflows/ai_pr_review.yml b/.github/workflows/ai_pr_review.yml
index 34ee6edea..07b28e022 100644
--- a/.github/workflows/ai_pr_review.yml
+++ b/.github/workflows/ai_pr_review.yml
@@ -517,7 +517,7 @@ jobs:
         if: steps.pr.outputs.is_fork == 'false'
         # Pinned to v1.11: v1.12 hangs after the turn completes
         # (openai/codex-action#150); re-bump once #151 ships.
-        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11
+        uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1.13
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           prompt-file: .github/codex/prompts/pr_review_compiled.md
diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index 3212ce72f..149d87494 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -67,7 +67,7 @@ jobs:
           fi
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ${{ matrix.artifact }}
           path: dist/*.whl
@@ -101,7 +101,7 @@ jobs:
         run: maturin build --release --out dist --features extension-module,accelerate
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: wheels-macos-arm64-py${{ matrix.python-version }}
           path: dist/*.whl
@@ -134,7 +134,7 @@ jobs:
         run: maturin build --release --out dist --features extension-module
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: wheels-windows-py${{ matrix.python-version }}
           path: dist/*.whl
@@ -159,7 +159,7 @@ jobs:
         run: maturin sdist --out dist
 
       - name: Upload sdist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sdist
           path: dist/*.tar.gz
diff --git a/.github/workflows/docs-tests.yml b/.github/workflows/docs-tests.yml
index 6e6e068e0..5357cc283 100644
--- a/.github/workflows/docs-tests.yml
+++ b/.github/workflows/docs-tests.yml
@@ -204,7 +204,7 @@ jobs:
           grep -q 'htmlToText' docs/_build/html/_static/searchtools.js
 
       - name: Set up Node for the search smoke test
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # Current LTS; jsdom's floor is far below this. Pinned so the
           # smoke test doesn't float with the runner image default.
diff --git a/.github/workflows/notebooks.yml b/.github/workflows/notebooks.yml
index d2e268dbe..ab16ed722 100644
--- a/.github/workflows/notebooks.yml
+++ b/.github/workflows/notebooks.yml
@@ -98,7 +98,7 @@ jobs:
 
       - name: Upload failed notebook outputs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: failed-notebook-outputs
           path: docs/tutorials/*.ipynb
@@ -154,7 +154,7 @@ jobs:
 
       - name: Upload failed notebook outputs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: failed-interop-notebook-outputs
           path: docs/tutorials/26_composition_drift_calibration.ipynb
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ceced767e..ab6523e52 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           path: dist
           merge-multiple: true