diff --git a/.github/workflows/_job_quality_check.yaml b/.github/workflows/_job_quality_check.yaml
index 84528f8e0..d28156687 100644
--- a/.github/workflows/_job_quality_check.yaml
+++ b/.github/workflows/_job_quality_check.yaml
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0 # full history gives Sonar accurate new-code / blame info
           show-progress: false # very verbose for not much
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         # uv is needed for qa and deploy, so is kinda always needed. No need to skip it.
         with:
           activate-environment: true
diff --git a/.github/workflows/_job_uv_audit.yaml b/.github/workflows/_job_uv_audit.yaml
index b21bdd792..9fd8701ad 100644
--- a/.github/workflows/_job_uv_audit.yaml
+++ b/.github/workflows/_job_uv_audit.yaml
@@ -36,7 +36,7 @@ jobs:
           token: ${{ secrets.token || secrets.GITHUB_TOKEN }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           activate-environment: true
           enable-cache: true
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 0bbf3e63a..2b705b182 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: python
           build-mode: none # Python is interpreted; no build step required
@@ -41,6 +41,6 @@ jobs:
           queries: security-extended
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: '/language:python'
diff --git a/.github/workflows/docs-check.yaml b/.github/workflows/docs-check.yaml
index 0ffe34c58..417ed1f0c 100644
--- a/.github/workflows/docs-check.yaml
+++ b/.github/workflows/docs-check.yaml
@@ -41,7 +41,7 @@ jobs:
           show-progress: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           activate-environment: true
           enable-cache: true
@@ -54,7 +54,7 @@ jobs:
 
       - name: Upload built docs
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: docs-html
           path: docs/build/html
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index bfef90ecb..3ef4a4c80 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -26,7 +26,7 @@ jobs:
           show-progress: false
       
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           activate-environment: true
           enable-cache: true
diff --git a/.github/workflows/release-v4.yaml b/.github/workflows/release-v4.yaml
index e10f5fab1..5ad6ae52f 100644
--- a/.github/workflows/release-v4.yaml
+++ b/.github/workflows/release-v4.yaml
@@ -43,7 +43,7 @@ jobs:
           fetch-depth: 0
           show-progress: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           activate-environment: true
           enable-cache: true