diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 686051e..40fc39f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Cache cargo
         # Tag runs re-verify a release: keep them off restored build state.
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
         with:
           workspaces: . -> target
           # A PR-written cache is invisible to main and evicts main's own by
@@ -94,7 +94,7 @@ jobs:
       - name: Cache cargo
         # Tag runs re-verify a release: keep them off restored build state.
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
         with:
           workspaces: . -> target
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -125,7 +125,7 @@ jobs:
           components: clippy
       - name: Cache cargo
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
         with:
           workspaces: . -> target
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -215,7 +215,7 @@ jobs:
           toolchain: ${{ steps.msrv.outputs.msrv }}
       - name: Cache cargo
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
         with:
           workspaces: . -> target
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -268,7 +268,7 @@ jobs:
           toolchain: "1.99.1"
       - name: Cache cargo
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
         with:
           workspaces: . -> target
           save-if: ${{ github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 12a36b7..f7f2407 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,11 +34,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Analyze
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 85603ee..7dd76ed 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           toolchain: "1.99.1"
       - name: Cache cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0  # v2.9.3
         with:
           workspaces: . -> target
           # Restore main's registry so the bench crate compiles; do not write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9214e2b..e893328 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -396,7 +396,7 @@ jobs:
           # workspace manifest.
           echo "VERSION=$GITHUB_REF_NAME" >>"$GITHUB_ENV"
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -586,7 +586,7 @@ jobs:
           path: /tmp/digests
           pattern: digests-*
           merge-multiple: true
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -718,7 +718,7 @@ jobs:
           toolchain: "1.99.1"
 
       - name: Authenticate to crates.io
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18  # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9  # v1.0.6
         id: auth
 
       - name: Publish crates