diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index c2c42fd4..f9762f83 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -162,7 +162,7 @@ jobs:
             benches/results/*.json
           if-no-files-found: warn
 
-      - uses: bencherdev/bencher@v0.6.13
+      - uses: bencherdev/bencher@v0.6.14
 
       # The project slug and API key go through the environment: `bencher` reads
       # BENCHER_PROJECT / BENCHER_API_KEY natively, and it keeps a maintainer-set
diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index 4ec56cba..1727aa3f 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -53,7 +53,7 @@ jobs:
           fetch-depth: 0 # such that setuptools_scm can do its job correctly
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v10.3.0
+        uses: astral-sh/setup-uv@v10.3.3
 
       - name: Build SDist
         id: sdist
@@ -97,7 +97,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v10.3.0
+        uses: astral-sh/setup-uv@v10.3.3
 
       - name: Render the base Dockerfile
         run: |
@@ -119,7 +119,7 @@ jobs:
           echo "ref=${BASE_IMAGE_NAME}:${hash}" >> "$GITHUB_OUTPUT"
 
       - name: Log in to the container registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -213,7 +213,7 @@ jobs:
           path: build/container/app
 
       - name: Log in to the container registry
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index dde8935f..1c2cda8e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -150,7 +150,7 @@ jobs:
           fi
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v10.3.1
+        uses: astral-sh/setup-uv@v10.3.3
 
       - name: Build SDist
         run: |
@@ -172,7 +172,7 @@ jobs:
           fetch-depth: 0  # such that hatch-vcs can read the tags
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v10.3.1
+        uses: astral-sh/setup-uv@v10.3.3
 
       - name: Build sdist and wheel
         run: uv build --package monoprop-bench-tools --out-dir bench-tools-dist
@@ -206,7 +206,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pypa/cibuildwheel@v4.3.3
+      - uses: pypa/cibuildwheel@v4.3.5
         with:
           extras: "uv"
         env:
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index d2419da1..0904cdd2 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v31.11.2
+        uses: cachix/install-nix-action@v31.11.3
 
       # Evaluates every output, the `nix run` app and the other interpreters'
       # packages included, without building; the checks are the per-interpreter
diff --git a/.github/workflows/qa-analysis.yml b/.github/workflows/qa-analysis.yml
index 00b11666..7d3ee590 100644
--- a/.github/workflows/qa-analysis.yml
+++ b/.github/workflows/qa-analysis.yml
@@ -215,7 +215,7 @@ jobs:
           name: coverage-reports
 
       - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v8.3.0
+        uses: SonarSource/sonarqube-scan-action@v8.4.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with: