diff --git a/.github/workflows/issue-metrics.yml b/.github/workflows/issue-metrics.yml
index 14fba5b9ec..fe73a81016 100644
--- a/.github/workflows/issue-metrics.yml
+++ b/.github/workflows/issue-metrics.yml
@@ -33,7 +33,7 @@ jobs:
         echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
 
     - name: Run issue-metrics tool
-      uses: github/issue-metrics@c9e9838147fd355dace335ba787f01b6641a400a # v4.2.2
+      uses: github/issue-metrics@9b1f360935d77e00b4ef6353216a3b46eafb70c4 # v4.2.4
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         SEARCH_QUERY: 'repo:zarr-developers/zarr-python is:issue created:${{ env.last_month }} -reason:"not planned"'
diff --git a/.github/workflows/zarr-metadata-release.yml b/.github/workflows/zarr-metadata-release.yml
index 809d502f16..9639fcfdd3 100644
--- a/.github/workflows/zarr-metadata-release.yml
+++ b/.github/workflows/zarr-metadata-release.yml
@@ -35,7 +35,7 @@ jobs:
       - name: Build
         run: hatch build
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: zarr-metadata-dist
           path: packages/zarr-metadata/dist
@@ -45,7 +45,7 @@ jobs:
     needs: [build]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: zarr-metadata-dist
           path: dist
@@ -76,7 +76,7 @@ jobs:
       id-token: write          # required for OIDC trusted publishing
       attestations: write      # required for artifact attestations
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: zarr-metadata-dist
           path: dist
@@ -87,7 +87,7 @@ jobs:
           subject-path: dist/*
 
       - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
 
   upload_testpypi:
     name: Upload to TestPyPI
@@ -101,7 +101,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: zarr-metadata-dist
           path: dist
@@ -112,6 +112,6 @@ jobs:
           subject-path: dist/*
 
       - name: Publish package to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           repository-url: https://test.pypi.org/legacy/