diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 447013f8..b64da071 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -261,4 +261,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 85cde1fa..093e5787 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -38,7 +38,7 @@ jobs:
           fi
           brew install --quiet just shfmt actionlint prek ripgrep shellcheck jq zsh
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: false
           github-token: ""
@@ -47,7 +47,7 @@ jobs:
         run: |
           uv tool install 'zizmor==1.29.0'
           zizmor --version
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
       # `just plugin-check` runs the harness's own validator against the