diff --git a/.github/workflows/ci-locks.yml b/.github/workflows/ci-locks.yml
index e244576..437d0c5 100644
--- a/.github/workflows/ci-locks.yml
+++ b/.github/workflows/ci-locks.yml
@@ -15,5 +15,5 @@ concurrency:
 
 jobs:
   refresh_lockfiles:
-    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2026.03.2
+    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2026.03.4
     secrets: inherit
diff --git a/.github/workflows/ci-manifest.yml b/.github/workflows/ci-manifest.yml
index a09e31d..dba1f68 100644
--- a/.github/workflows/ci-manifest.yml
+++ b/.github/workflows/ci-manifest.yml
@@ -25,4 +25,4 @@ concurrency:
 jobs:
   manifest:
     name: "check-manifest"
-    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2026.03.2
+    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2026.03.4
diff --git a/.github/workflows/ci-template-check.yml b/.github/workflows/ci-template-check.yml
index 3d0bb0d..46cb96c 100644
--- a/.github/workflows/ci-template-check.yml
+++ b/.github/workflows/ci-template-check.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   prompt-share:
-    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2026.03.2
+    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2026.03.4
     secrets: inherit
     with:
       pr_number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 7ed4cf0..669829f 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -71,6 +71,6 @@ jobs:
 
       - name: "upload coverage report"
         if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad
         with:
           token: ${{ secrets.CODECOV_TOKEN }}