diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 392314e2..800538d3 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -13,9 +13,9 @@ jobs:
   autofix:
     runs-on: ubuntu-latest
     steps:
-      - uses: mhils/workflows/checkout@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-python@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-uv@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+      - uses: mhils/workflows/checkout@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-python@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-uv@16608e9df5912db0e3ad86a9b90e25e933f2496b
 
       - run: uv lock
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 96f35e90..2e2e0a12 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,7 +18,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
       - uses: actions/setup-python@v5
@@ -31,7 +31,7 @@ jobs:
       # We use a custom build script for pdoc itself, ideally you just run `pdoc -o docs/ ...` here.
       - run: python docs/make.py
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v4
         with:
           path: docs/
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3420067e..0b9b685d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -18,17 +18,17 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: mhils/workflows/checkout@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-python@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-uv@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+      - uses: mhils/workflows/checkout@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-python@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-uv@16608e9df5912db0e3ad86a9b90e25e933f2496b
       - run: uv run tox -e lint
 
   old-dependencies:
     runs-on: ubuntu-latest
     steps:
-      - uses: mhils/workflows/checkout@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-python@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-uv@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+      - uses: mhils/workflows/checkout@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-python@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-uv@16608e9df5912db0e3ad86a9b90e25e933f2496b
       - run: uv run tox -e old-dependencies
 
   test:
@@ -55,12 +55,12 @@ jobs:
             py: 3.9.18
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: mhils/workflows/checkout@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
-      - uses: mhils/workflows/setup-uv@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+      - uses: mhils/workflows/checkout@16608e9df5912db0e3ad86a9b90e25e933f2496b
+      - uses: mhils/workflows/setup-uv@16608e9df5912db0e3ad86a9b90e25e933f2496b
       - run: uv run --python ${{ matrix.py }} tox -e py -- -vvv ${{ matrix.args }}
 
   build:
-    uses: mhils/workflows/.github/workflows/python-build.yml@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+    uses: mhils/workflows/.github/workflows/python-build.yml@16608e9df5912db0e3ad86a9b90e25e933f2496b
     permissions:
       contents: read
       id-token: write
@@ -75,11 +75,11 @@ jobs:
       attestations: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           name: wheels
           path: dist/
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@v3
         with:
           subject-path: 'dist/*'
 
@@ -90,13 +90,13 @@ jobs:
     - test
     - build
     - attest
-    uses: mhils/workflows/.github/workflows/alls-green.yml@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+    uses: mhils/workflows/.github/workflows/alls-green.yml@16608e9df5912db0e3ad86a9b90e25e933f2496b
     with:
       jobs: ${{ toJSON(needs) }}
       allowed-skips: '["attest"]'
 
   deploy:
-    uses: mhils/workflows/.github/workflows/python-deploy.yml@03ded8ba339159d99d08c21a4b0d1c38f3f52c3b
+    uses: mhils/workflows/.github/workflows/python-deploy.yml@16608e9df5912db0e3ad86a9b90e25e933f2496b
     with:
       artifact-name: wheels
     needs: check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c115261a..068200e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
     environment: deploy
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         token: ${{ secrets.GH_PUSH_TOKEN }}  # this token works to push to the protected main branch.
         persist-credentials: true