diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f5593e0..36079b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -243,7 +243,7 @@ jobs:
           components: llvm-tools-preview
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2
+        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2
         with:
           tool: cargo-llvm-cov
       # Instrument and run the tests once; the two `report` steps below reuse
@@ -263,7 +263,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
       - name: Coverage HTML report
         run: cargo llvm-cov report --html --output-dir coverage-report
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-report-${{ matrix.os }}
           path: coverage-report
@@ -348,7 +348,7 @@ jobs:
           cat perf-comparison.md >> "$GITHUB_STEP_SUMMARY"
       - name: Upload benchmark history point
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: perf-history-${{ matrix.os }}
           path: |
@@ -481,7 +481,7 @@ jobs:
       # equivalent (`typos .`). Gating: every finding to date has been a
       # genuine misspelling fixed in the source, not a domain term needing an
       # exclusion (see `typos.toml`'s own comments).
-      - uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
+      - uses: crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b # v1.51.1
 
   docs-links:
     name: docs links (internal)
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a99aed0..efe381a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -85,4 +85,4 @@ jobs:
           path: book
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index cafe422..2aae3bd 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -89,7 +89,7 @@ jobs:
       # (with the sanitizer this build enables) leaks.
       - name: Upload crash artifacts
         if: steps.fuzz.outcome == 'failure'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-crash-${{ matrix.target }}
           path: fuzz/artifacts/${{ matrix.target }}
diff --git a/.github/workflows/interop.yml b/.github/workflows/interop.yml
index f18aa10..dd6be4a 100644
--- a/.github/workflows/interop.yml
+++ b/.github/workflows/interop.yml
@@ -262,7 +262,7 @@ jobs:
 
       - name: Upload the scenario report
         if: ${{ always() && steps.release.outputs.skip_reason == '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: interop-report-${{ matrix.os }}
           path: interop-report.json
diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index c0af573..e3be2ba 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -150,7 +150,7 @@ jobs:
 
       - name: Upload mutants report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutants-out-shard-${{ matrix.shard }}
           path: mutants.out
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fc573b7..62b94f6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -97,7 +97,7 @@ jobs:
       - name: Mint GitHub App token
         id: app-token
         if: ${{ vars.RELEASE_APP_ID != '' }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
@@ -140,7 +140,7 @@ jobs:
         run: cargo install cargo-edit --locked
 
       - name: Install git-cliff
-        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2
+        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2
         with:
           tool: git-cliff@2