diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b1f08d65..54d2d5a0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -112,7 +112,7 @@ jobs:
         run: |
           uv tool run --from build pyproject-build --verbose --sdist --installer uv
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@v7
         with:
           name: cibw-sdist
           path: dist/*.tar.gz
@@ -142,7 +142,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pypa/cibuildwheel@v4.1.1
+      - uses: pypa/cibuildwheel@v4.2.0
         with:
           extras: "uv"
         env:
@@ -151,7 +151,7 @@ jobs:
           CIBW_DEBUG_TRACEBACK: TRUE
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
           path: wheelhouse/*.whl
@@ -171,7 +171,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@v8
         with:
           # unpacks all CIBW artifacts into dist/
           pattern: cibw-*
@@ -198,7 +198,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@v8
         with:
           pattern: cibw-*
           path: dist
diff --git a/.github/workflows/docpages.yml b/.github/workflows/docpages.yml
index 09cb071e..307a7f60 100644
--- a/.github/workflows/docpages.yml
+++ b/.github/workflows/docpages.yml
@@ -90,7 +90,7 @@ jobs:
       # main): the Cloudflare deploy job below needs `docs/out` for PR builds
       # too, to publish a preview.
       - name: Upload docs site artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@v7
         with:
           name: docs-site
           path: docs/out
@@ -116,7 +116,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Download docs site artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@v8
         with:
           name: docs-site
           path: docs/out
diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml
index 10ca53d4..90f5e8bb 100644
--- a/.github/workflows/issue-labeler.yml
+++ b/.github/workflows/issue-labeler.yml
@@ -11,7 +11,7 @@ jobs:
       issues: write
     steps:
       - name: Add labels based on issue content
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const title = context.payload.issue.title.toLowerCase();
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index d8006cec..1263dd82 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -11,7 +11,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v7
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cb6e9105..6d473c56 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run prek for linting
-        uses: j178/prek-action@v2.0.6
+        uses: j178/prek-action@v3.0.0
         env:
           RUFF_OUTPUT_FORMAT: github
         with:
diff --git a/.github/workflows/qa-analysis.yml b/.github/workflows/qa-analysis.yml
index 9fa1ba82..c88e5c3e 100644
--- a/.github/workflows/qa-analysis.yml
+++ b/.github/workflows/qa-analysis.yml
@@ -130,7 +130,7 @@ jobs:
           fail_ci_if_error: true
 
       - name: Upload coverage reports for SonarQube
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-reports
           path: |
@@ -172,7 +172,7 @@ jobs:
           uv sync --no-progress --all-extras -v
 
       - name: Download coverage reports
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: coverage-reports