diff --git a/.github/workflows/dist.yml b/.github/workflows/dist.yml
index 22a3edb1ed..a68e2e6281 100644
--- a/.github/workflows/dist.yml
+++ b/.github/workflows/dist.yml
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
           ref: ${{ inputs.ref }}
 
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           cache: 'pip'
           python-version: 3.11
@@ -111,7 +111,7 @@ jobs:
           persist-credentials: false
           ref: ${{ inputs.ref }}
 
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           # Build sdist on lowest supported Python
           python-version: "3.9"
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 1dbd7ff43a..9fb534aebe 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -81,7 +81,7 @@ jobs:
           path: dist/
       - name: Publish package distributions to PyPI
         if: startsWith(env.DRY_RUN, 'false')
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
 
   post-publish:
     needs: [publish]
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 3d6a11cf5b..91af8d840c 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6.3.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.10"
 
diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
index b288516b68..a5f8ad632d 100644
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -106,7 +106,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -135,7 +135,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -161,7 +161,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -184,7 +184,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "${{matrix.python}}"
@@ -206,7 +206,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/set-uv-exclude-newer
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           python-version: "3.10"
@@ -235,7 +235,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           cache: 'pip'
           cache-dependency-path: 'pyproject.toml'
@@ -269,7 +269,7 @@ jobs:
             mkdir test
             tar --strip-components=1 -zxf *.tar.gz -C ./test
             ls test
-        - uses: actions/setup-python@v6.3.0
+        - uses: actions/setup-python@v7.0.0
           with:
             cache: 'pip'
             cache-dependency-path: 'sdist/test/pyproject.toml'
@@ -297,7 +297,7 @@ jobs:
             persist-credentials: false
         - uses: ./.github/actions/set-uv-exclude-newer
         - name: Install uv
-          uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+          uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
           with:
             python-version: "3.9"
         - id: setup-mongodb
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index f333cfa665..2520b35175 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -18,4 +18,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1