diff --git a/.github/workflows/cla-reusable.yml b/.github/workflows/cla-reusable.yml
index 4cd68af..7257634 100644
--- a/.github/workflows/cla-reusable.yml
+++ b/.github/workflows/cla-reusable.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Generate token from GitHub App
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0fc865d..9cd8bc2 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -47,7 +47,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - id: read
         env:
           IMAGE: ${{ inputs.image }}
diff --git a/.github/workflows/maturin-wheels.yml b/.github/workflows/maturin-wheels.yml
index 201e99e..f35c385 100644
--- a/.github/workflows/maturin-wheels.yml
+++ b/.github/workflows/maturin-wheels.yml
@@ -94,7 +94,7 @@ jobs:
           sccache: false
           manylinux: ${{ matrix.build.manylinux }}
           before-script-linux: ${{ steps.args.outputs.before }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wheels-${{ matrix.build.family }}-${{ matrix.build.target }}
           path: dist
@@ -109,7 +109,7 @@ jobs:
         with:
           command: sdist
           args: --out dist
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: wheels-sdist
           path: dist
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6181479..050e924 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -58,7 +58,7 @@ jobs:
           path: .shared
           persist-credentials: false
       - if: inputs.artifacts != ''
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ inputs.artifacts }}
           path: dist
@@ -70,7 +70,7 @@ jobs:
           output-file: sbom/${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
           upload-artifact: false
           upload-release-assets: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
@@ -112,7 +112,7 @@ jobs:
           TOKEN: ${{ secrets.registry-token }}
         run: echo "login=$([ -n "$TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
       - if: steps.auth.outputs.login == 'true'
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ inputs.registry-username }}
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 3fc056e..1dadef6 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - env:
           SYNC_ARGS: ${{ inputs.uv-sync-args }}
         run: |
@@ -84,7 +84,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - if: inputs.secret-env != '[]'
@@ -126,7 +126,7 @@ jobs:
           files: ${{ inputs.working-directory }}/cov.xml
           fail_ci_if_error: false
       - if: always() && inputs.artifacts != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-${{ matrix.python-version }}
           path: ${{ inputs.working-directory }}/${{ inputs.artifacts }}
diff --git a/.github/workflows/python-versions.yml b/.github/workflows/python-versions.yml
index 9de4a18..67f2037 100644
--- a/.github/workflows/python-versions.yml
+++ b/.github/workflows/python-versions.yml
@@ -32,7 +32,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - id: read
         env:
           ROOT: ${{ inputs.working-directory }}
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 04497ff..3f9dd3f 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -50,7 +50,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - id: tag
         env:
           ROOT: ${{ inputs.working-directory }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f913324..452b550 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,5 +19,5 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - run: uv run --group dev actionlint