diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 477eecc..ac12697 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -28,17 +28,17 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 240
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       # This Python only runs the `astropy-integration` orchestrator CLI;
       # the test venv for `matrix.python` is built separately by uv (see
       # the `run` step below), so a fixed version is fine here.
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: '3.12'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3.2.4
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           # We manage the cache ourselves via actions/cache below; turning
           # off setup-uv's own caching avoids it saving a duplicate of the
@@ -46,7 +46,7 @@ jobs:
           enable-cache: false
 
       - name: Cache ~/.cache/uv
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: ~/.cache/uv
           # Primary key uses the run id, so every run writes a fresh
@@ -80,7 +80,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: results-${{ matrix.variant }}-${{ matrix.python }}
           path: results/${{ matrix.variant }}__${{ matrix.python }}.json
@@ -91,9 +91,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: '3.12'
 
@@ -101,7 +101,7 @@ jobs:
         run: pip install .
 
       - name: Download all variant results
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: results-*
           merge-multiple: true
diff --git a/.github/workflows/preview-link.yml b/.github/workflows/preview-link.yml
index 5a9b47f..4e84061 100644
--- a/.github/workflows/preview-link.yml
+++ b/.github/workflows/preview-link.yml
@@ -21,7 +21,7 @@ jobs:
       statuses: write   # to attach a status check to the source commit
       actions: read     # to look up the source workflow's artifact id
     steps:
-      - uses: agriyakhetarpal/github-actions-artifacts-redirector-action@683d25ace2cb0aefe8e6719c39c2ac7f3d22dd8c  # v1.0.0
+      - uses: agriyakhetarpal/github-actions-artifacts-redirector-action@3514efb6f242bd9c0a28ea93564c19a2ad7367d2  # v1.0.2
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           # With `archive: false`, artifact-name is the uploaded file's