diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4bf97f2a..2d1f22a3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,7 +91,7 @@ jobs:
           enable-cache: true
       - run: uv sync --frozen --only-group dev
       - run: uv run --frozen coverage combine coverage-data-*
-      - uses: py-cov-action/python-coverage-comment-action@5d8df5979747514c914e1c5a12335a7cf9a2745f
+      - uses: py-cov-action/python-coverage-comment-action@a05be3d2e8a6272d3ef5fb2840ab20368bb2eb71
         id: coverage_comment
         with:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/publish_pypi.yml b/.github/workflows/publish_pypi.yml
index 2a492bba..d12e543e 100644
--- a/.github/workflows/publish_pypi.yml
+++ b/.github/workflows/publish_pypi.yml
@@ -31,4 +31,4 @@ jobs:
           version: "0.9.7"
           enable-cache: false
       - run: uv build --verbose
-      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 06a8384a..e9b91727 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -23,4 +23,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2