diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 15e097e..8b4f558 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -87,7 +87,7 @@ jobs:
         if: always()
 
       - name: Publish test results
-        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3  # v2.24.0
+        uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d  # v2.25.0
         with:
           files: '**/junit.xml'
 
@@ -129,7 +129,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions-ext/python/setup@ec67f82b3bd863948308a41ecb9e70547cbb19c7
+        uses: actions-ext/python/setup@c8228d827a81b9f8c808825328af361c45461ba3
         with:
           version: "3.11"
 
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 21d5c73..5972380 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -27,7 +27,7 @@ jobs:
           version: "3.11"
 
       - name: Download distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8
         with:
           pattern: dist
           merge-multiple: true
diff --git a/dau_core/tests/test_validation_at_use.py b/dau_core/tests/test_validation_at_use.py
index 4d2dc15..7153b85 100644
--- a/dau_core/tests/test_validation_at_use.py
+++ b/dau_core/tests/test_validation_at_use.py
@@ -157,7 +157,11 @@ def test_every_model_validates_at_use() -> None:
             continue
         loaded = importlib.import_module(module.name)
         for _name, cls in inspect.getmembers(loaded, inspect.isclass):
-            if not issubclass(cls, BaseModel) or cls is BaseModel or cls.__module__ != module.name or cls in seen:
+            if not issubclass(cls, BaseModel) or cls is BaseModel or cls in seen:
+                continue
+            # a parametrized generic belongs to its origin: from pydantic 2.14
+            # its own __module__ is wherever it happened to be parametrized
+            if (cls.__pydantic_generic_metadata__["origin"] or cls).__module__ != module.name:
                 continue
             seen.add(cls)
             if not hasattr(cls, "check") or not cls.model_config.get("frozen"):