diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 52700d2a3..a3180c8fc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ permissions: {}
 
 jobs:
   core:
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2  # zizmor: ignore[unpinned-uses]
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v3.0.1  # zizmor: ignore[unpinned-uses]
     with:
       submodules: false
       coverage: codecov
@@ -37,10 +37,10 @@ jobs:
   sdist_verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6  # zizmor: ignore[unpinned-uses]
+      - uses: actions/checkout@v7  # zizmor: ignore[unpinned-uses]
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6  # zizmor: ignore[unpinned-uses]
+      - uses: actions/setup-python@v7  # zizmor: ignore[unpinned-uses]
         with:
           python-version: '3.13'
       - run: python -m pip install -U --user build
@@ -50,7 +50,7 @@ jobs:
 
   test:
     needs: [core, sdist_verify]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2  # zizmor: ignore[unpinned-uses]
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v3.0.1  # zizmor: ignore[unpinned-uses]
     with:
       submodules: false
       coverage: codecov
@@ -67,7 +67,7 @@ jobs:
 
   docs:
     needs: [core]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2  # zizmor: ignore[unpinned-uses]
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v3.0.1  # zizmor: ignore[unpinned-uses]
     with:
       default_python: '3.13'
       submodules: false
@@ -91,7 +91,7 @@ jobs:
         github.event_name == 'pull_request' &&
         contains(github.event.pull_request.labels.*.name, 'Run cron CI')
       )
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2  # zizmor: ignore[unpinned-uses]
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v3.0.1  # zizmor: ignore[unpinned-uses]
     with:
       default_python: '3.13'
       submodules: false
@@ -112,7 +112,7 @@ jobs:
         contains(github.event.pull_request.labels.*.name, 'Run publish')
       )
     needs: [test, docs]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@v2  # zizmor: ignore[unpinned-uses]
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@v3.0.1  # zizmor: ignore[unpinned-uses]
     with:
       python-version: '3.13'
       test_extras: 'all,tests'
@@ -141,7 +141,7 @@ jobs:
       - run: ls -lha dist/
 
       - name: Run upload
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1
 
   notify:
     if: ${{ !cancelled() && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
diff --git a/.github/workflows/stale_bot.yml b/.github/workflows/stale_bot.yml
index d8779896e..2a17754dc 100644
--- a/.github/workflows/stale_bot.yml
+++ b/.github/workflows/stale_bot.yml
@@ -18,7 +18,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-    - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         operations-per-run: 50
diff --git a/.github/workflows/sub_package_update.yml b/.github/workflows/sub_package_update.yml
index c81875654..613a53f65 100644
--- a/.github/workflows/sub_package_update.yml
+++ b/.github/workflows/sub_package_update.yml
@@ -22,11 +22,11 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6  # zizmor: ignore[unpinned-uses]
+      - uses: actions/checkout@v7  # zizmor: ignore[unpinned-uses]
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6  # zizmor: ignore[unpinned-uses]
+      - uses: actions/setup-python@v7  # zizmor: ignore[unpinned-uses]
         with:
           python-version: "3.14"