diff --git a/.github/workflows/oa_update.yml b/.github/workflows/oa_update.yml
index 466df34..7aa3e43 100644
--- a/.github/workflows/oa_update.yml
+++ b/.github/workflows/oa_update.yml
@@ -21,7 +21,7 @@ jobs:
       fail-fast: true
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 0
 
@@ -63,7 +63,7 @@ jobs:
 
       - name: Create pull request
         if: steps.check.outputs.has_changes == '1'
-        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412  # v7.0.9
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676  # v7.0.11
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           draft: ${{ steps.merge.outputs.has_conflicts == '1' }}
diff --git a/.github/workflows/pre-commit-update.yaml b/.github/workflows/pre-commit-update.yaml
index a0b7308..cb67a01 100644
--- a/.github/workflows/pre-commit-update.yaml
+++ b/.github/workflows/pre-commit-update.yaml
@@ -21,11 +21,11 @@ jobs:
       fail-fast: true
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548  # v6.1.0
 
       - name: Install pre-commit
         run: pip install pre-commit
@@ -35,7 +35,7 @@ jobs:
         run: pre-commit autoupdate -c '{{ cookiecutter.package_name }}/.pre-commit-config.yaml'
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412  # v7.0.9
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676  # v7.0.11
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           delete-branch: true
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ce37b8b..5bdfa30 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   test:
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@d9b81a07e789d1b1921ab5fe33de2ddcbbd02c3f  # v2.3.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@9f1fedda61294df4c004c05519a3fbf3b8e1f32f  # v2.3.1
     with:
       envs: |
         - macos: py312-test
@@ -21,7 +21,7 @@ jobs:
         - linux: build_docs
 
   bake_cookies:
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@d9b81a07e789d1b1921ab5fe33de2ddcbbd02c3f  # v2.3.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@9f1fedda61294df4c004c05519a3fbf3b8e1f32f  # v2.3.1
     with:
       artifact-path: |
         cookies