diff --git a/.github/workflows/adoption-refresh.yml b/.github/workflows/adoption-refresh.yml
index 1381260..e80f1cd 100644
--- a/.github/workflows/adoption-refresh.yml
+++ b/.github/workflows/adoption-refresh.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - name: Derive
         working-directory: adoption
         env:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af2b534..2df0a3e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - name: Test
         working-directory: adoption
         run: uv run pytest
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b69f4f1..75bf46e 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -66,7 +66,7 @@ jobs:
       # MSRV (cargo-audit 0.22.2 requires Rust >=1.88) from the audited
       # crate's MSRV (1.85). The exact scanner version is pinned and
       # deliberately reviewed, never floated.
-      - uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2.87.1
+      - uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
         with:
           tool: cargo-audit@0.22.2
       - name: cargo audit