diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
index c18e72cf2..3bd3176b4 100644
--- a/.github/workflows/auto-label.yml
+++ b/.github/workflows/auto-label.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Size labeling for PRs
         if: github.event_name == 'pull_request_target'
-        uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9 # v1.10.4
+        uses: codelytv/pr-size-labeler@19c335e7695ba922de938806dd129f0a9b992644 # v1.12.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           xs_label: 'size/xs'
diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index 5ce166216..e38ddad08 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -47,7 +47,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "latest"
           enable-cache: true
@@ -88,7 +88,7 @@ jobs:
         # traceback of any failed notebook to <outdir>/reports/<docname>.err.log
         # rather than aborting. Nothing else in the deploy log carries it.
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: notebook-error-logs
           path: docs/_build/html/reports
@@ -115,7 +115,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload the docs build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: docs-html
           path: docs/_build/html
@@ -143,13 +143,13 @@ jobs:
           persist-credentials: false
 
       - name: Download the docs build
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: docs-html
           path: docs/_build/html
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 69a3a0038..8611b1e4a 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -39,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Run the reviewer agent
-        uses: anthropics/claude-code-action@cab360f6565aa35a51d6ce9e43f1f4287c0a32ea # v1.0.241
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1.0.248
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           trigger_phrase: "@claude-pr-review"
diff --git a/.github/workflows/full_render_notebooks.yml b/.github/workflows/full_render_notebooks.yml
index 60a12e90f..d48e494af 100644
--- a/.github/workflows/full_render_notebooks.yml
+++ b/.github/workflows/full_render_notebooks.yml
@@ -40,7 +40,7 @@ jobs:
       # scheduled and manual runs read or write the cache. zizmor evaluates the
       # workflow statically and cannot see through the expression.
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v7 # zizmor: ignore[cache-poisoning]
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v7 # zizmor: ignore[cache-poisoning]
         with:
           version: "latest"
           enable-cache: ${{ github.event_name != 'release' }}
@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload the link-check report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: docs-linkcheck
           path: docs/_build/linkcheck
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 275dea5c1..faa3efb72 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -36,7 +36,7 @@ jobs:
 
       # Install uv
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "latest"
           enable-cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f3494c931..26a5c565c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -95,7 +95,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           # No cache on a release run: a tag push is a publishing event, so
           # anything it writes to the shared cache would be restored by later
@@ -141,7 +141,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           enable-cache: false # see the note in multi-platform-tests
 
@@ -159,7 +159,7 @@ jobs:
           uv run bandit -r gpjax/ -f json -o bandit-report.json || echo "Bandit scan completed with warnings"
 
       - name: Upload security reports
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: security-reports
           path: |
@@ -186,7 +186,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           enable-cache: false # see the note in multi-platform-tests
 
@@ -200,7 +200,7 @@ jobs:
           uv run twine check dist/*
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: dist-packages
           path: dist/
@@ -281,7 +281,7 @@ jobs:
           persist-credentials: false
 
       - name: Download build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: dist-packages
           path: dist/
@@ -326,7 +326,7 @@ jobs:
 
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: dist-packages
           path: dist/
diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml
index 95145151d..697f4e33b 100644
--- a/.github/workflows/ruff.yml
+++ b/.github/workflows/ruff.yml
@@ -27,7 +27,7 @@ jobs:
       # means a new release can turn every open PR red without a commit having
       # been made — which is exactly what the PLR0917 stabilisation did.
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "latest"
           enable-cache: true
diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
index ec50179f2..3d1483a8f 100644
--- a/.github/workflows/security-analysis.yml
+++ b/.github/workflows/security-analysis.yml
@@ -40,7 +40,7 @@ jobs:
         python-version: '3.11'
 
     - name: Install uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         version: "latest"
         enable-cache: true
@@ -62,7 +62,7 @@ jobs:
         uv run bandit -r gpjax/ -f json -o bandit-report.json -ll
 
     - name: Upload dependency scan results
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       if: always()
       with:
         name: security-scan-results
@@ -86,7 +86,7 @@ jobs:
         persist-credentials: false
 
     - name: Run TruffleHog OSS
-      uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
+      uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
       with:
         path: ./
         # `--exclude-detectors=lob`: TruffleHog's Lob key pattern is
diff --git a/.github/workflows/test_docs.yml b/.github/workflows/test_docs.yml
index 8b0bfe447..6ed7f05f0 100644
--- a/.github/workflows/test_docs.yml
+++ b/.github/workflows/test_docs.yml
@@ -40,7 +40,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "latest"
           enable-cache: true
@@ -124,7 +124,7 @@ jobs:
         # deployments are unsupported on this plan and silently deploy to the
         # production URL, so the job that used to live here was replacing the
         # published docs with a PR's smoke render.
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: docs-smoke-render
           path: docs/_build/html
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6e290f1a5..8b17edfd3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -36,7 +36,7 @@ jobs:
 
       # Install uv
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "latest"
           enable-cache: true
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 752beb310..7288fb2a2 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -43,7 +43,7 @@ jobs:
       # zizmor@latest` would turn every open PR red without a commit having been
       # made. Dependabot bumps the pin via the `uv` ecosystem.
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "latest"
           enable-cache: true
@@ -68,7 +68,7 @@ jobs:
 
       - name: Upload the SARIF report
         if: always()
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         # Pull requests from forks get a read-only GITHUB_TOKEN, so the upload
         # is rejected there. That must not fail the audit — the findings still
         # appear in the step log below, and the gate step still blocks the PR.