diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index c5f9d1b4..89edab90 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -26,4 +26,4 @@ jobs:
 
       - uses: mhils/add-pr-ref-in-changelog@6df8cd5a0c4d0a8c0353b663153d4a36384054f4
 
-      - uses: autofix-ci/action@7a166d7532b277f34e16238930461bf77f9d7ed8
+      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 26b6a9be..03a2880c 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,10 +18,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.14'
 
@@ -31,7 +31,7 @@ jobs:
       # We use a custom build script for pdoc itself, ideally you just run `pdoc -o docs/ ...` here.
       - run: python docs/make.py
 
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: docs/
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 615a05d3..ec36cb61 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -79,7 +79,7 @@ jobs:
         with:
           name: wheels
           path: dist/
-      - uses: actions/attest-build-provenance@v4
+      - uses: actions/attest-build-provenance@v4.1.0
         with:
           subject-path: 'dist/*'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a4a38cb..3b4cad7e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
     environment: deploy
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v6.0.2
       with:
         token: ${{ secrets.GH_PUSH_TOKEN }}  # this token works to push to the protected main branch.
         persist-credentials: true