diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f62ec4e..1e55156 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -132,7 +132,7 @@ jobs:
           shared-key: test-${{ matrix.target }}
           cache-bin: false
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
         with:
           tool: nextest@0.9.146
           fallback: none
@@ -179,7 +179,7 @@ jobs:
           shared-key: check-${{ matrix.target }}
           cache-bin: false
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
         with:
           tool: nextest@0.9.146
           fallback: none
@@ -235,7 +235,7 @@ jobs:
       - run: cargo build -p wit-language-server --release --locked --target "$TARGET"
       - run: cargo xtask package-release --target "$TARGET" --output dist
       - run: cargo xtask collect-licenses --target "$TARGET" --output dist
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: native-${{ matrix.target }}
           path: dist/*
@@ -255,7 +255,7 @@ jobs:
           persist-credentials: false
       - name: Install pinned toolchain
         run: rustup toolchain install
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: native-*
           path: dist
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index da8cf7b..e040b28 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -297,7 +297,7 @@ jobs:
           save-if: false
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
         with:
           tool: nextest@0.9.146
           fallback: none
@@ -314,7 +314,7 @@ jobs:
       - name: Collect target redistribution notices
         run: cargo xtask collect-licenses --target "$TARGET" --output dist
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-${{ matrix.target }}
           path: dist/*
@@ -338,7 +338,7 @@ jobs:
         run: rustup toolchain install
 
       - name: Download LSP artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-*
           path: dist
@@ -359,7 +359,7 @@ jobs:
       attestations: write
     steps:
       - name: Download LSP artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-*
           path: dist
@@ -619,7 +619,7 @@ jobs:
 
       - name: Download LSP artifacts
         if: ${{ inputs.scope == 'lsp' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-*
           path: dist