diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 4e44f7f8c5f..61132608854 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -12,10 +12,10 @@ jobs:
     name: Autoupdate changelog entry and headers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.12'
       - run: pip install --upgrade towncrier pygithub gitpython numpy
diff --git a/.github/workflows/autopush.yml b/.github/workflows/autopush.yml
index 51ceaaad417..cd0436a67f0 100644
--- a/.github/workflows/autopush.yml
+++ b/.github/workflows/autopush.yml
@@ -11,7 +11,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: true
           token: ${{ secrets.MNE_BOT_TOKEN }}
diff --git a/.github/workflows/check_changelog.yml b/.github/workflows/check_changelog.yml
index 222810abde6..4d45709b787 100644
--- a/.github/workflows/check_changelog.yml
+++ b/.github/workflows/check_changelog.yml
@@ -13,7 +13,7 @@ jobs:
     name: Check towncrier entry in doc/changes/dev/
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: scientific-python/action-towncrier-changelog@v2
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 159c25e569f..c70e4cef9f1 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6.0.3
+      uses: actions/checkout@v7.0.0
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/credit.yml b/.github/workflows/credit.yml
index 8d28e076799..d2974068e6c 100644
--- a/.github/workflows/credit.yml
+++ b/.github/workflows/credit.yml
@@ -17,10 +17,10 @@ jobs:
       GH_TOKEN: ${{ secrets.MNE_BOT_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.MNE_BOT_TOKEN }}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.12'
       - run: pip install pygithub -e .
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7d3d0bc4c86..bfa23bb52d5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,10 +16,10 @@ jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.10'
       - name: Install dependencies
diff --git a/.github/workflows/spec_zero.yml b/.github/workflows/spec_zero.yml
index e63b3d4d55d..cb0aba1f6af 100644
--- a/.github/workflows/spec_zero.yml
+++ b/.github/workflows/spec_zero.yml
@@ -25,7 +25,7 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: true
       - name: Triage SSH
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a8b24aa0d3c..7f04a6858b5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: '3.14'
       - uses: pre-commit/action@v3.0.1
@@ -91,7 +91,7 @@ jobs:
             python: '3.14t'  # free-threaded
             kind: pip-ft
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -118,7 +118,7 @@ jobs:
           pyvista: false
           wm: false
       # Python (if pip)
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python }}
         if: startswith(matrix.kind, 'pip') || matrix.kind == 'minimal'
@@ -152,7 +152,7 @@ jobs:
       - run: python ./tools/github_actions_check_old_env.py
         if: matrix.kind == 'old'
       # Minimal commands on Linux (macOS stalls)
-      - uses: actions/cache@v5
+      - uses: actions/cache@v5.0.5
         with:
           key: minimal-commands-1
           path: ~/minimal_cmds
@@ -167,7 +167,7 @@ jobs:
         run: MNE_SKIP_TESTING_DATASET_TESTS=true pytest -m "not (ultraslowtest or pgtest)" --tb=short --cov=mne --cov-report xml -vv -rfE mne/
         if: matrix.kind == 'minimal'
       - run: ./tools/get_testing_version.sh
-      - uses: actions/cache@v5
+      - uses: actions/cache@v5.0.5
         with:
           key: ${{ env.TESTING_VERSION }}
           path: ~/mne_data