diff --git a/.github/actions/codecov/action.yml b/.github/actions/codecov/action.yml
index 3b59d4d..4757f92 100644
--- a/.github/actions/codecov/action.yml
+++ b/.github/actions/codecov/action.yml
@@ -19,11 +19,11 @@ runs:
         packages: "${{ inputs.packages }}"
     - shell: bash
       run: rustup component add llvm-tools-preview
-    - uses: taiki-e/install-action@c3ec0de9ae7f1019cea21aa96aa0a895b9552063 # v2.87.9
+    - uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2.87.19
       with:
         tool: nextest
     - name: Install cargo-llvm-cov
-      uses: taiki-e/install-action@c3ec0de9ae7f1019cea21aa96aa0a895b9552063 # v2.87.9
+      uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2.87.19
       with:
         tool: cargo-llvm-cov
     - name: Clean the workspace
@@ -36,6 +36,6 @@ runs:
       shell: bash
       run: cargo llvm-cov nextest --lcov --output-path lcov.info --profile ci --release --workspace
     - name: Upload coverage data to codecov
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       with:
         files: lcov.info
diff --git a/.github/actions/gpu-ci/action.yml b/.github/actions/gpu-ci/action.yml
index 2728f3d..86ae466 100644
--- a/.github/actions/gpu-ci/action.yml
+++ b/.github/actions/gpu-ci/action.yml
@@ -35,7 +35,7 @@ runs:
       if: inputs.packages != ''
       with:
         packages: "${{ inputs.packages }}"
-    - uses: taiki-e/install-action@c3ec0de9ae7f1019cea21aa96aa0a895b9552063 # v2.87.9
+    - uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2.87.19
       with:
         tool: nextest
     - name: GPU tests
diff --git a/.github/actions/lint-workflows/action.yml b/.github/actions/lint-workflows/action.yml
index 48a478a..5d42fae 100644
--- a/.github/actions/lint-workflows/action.yml
+++ b/.github/actions/lint-workflows/action.yml
@@ -45,7 +45,7 @@ runs:
     # Note that `continue-on-error` is silently ignored on composite action
     # steps, so any zizmor finding fails the calling job. Suppress findings
     # that don't apply via `.github/zizmor.yml` or `# zizmor: ignore` comments.
-    - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+    - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
       with:
         config: ${{ inputs.zizmor-config }}
         # Mutually exclusive with `annotations`; the Security tab needs
diff --git a/.github/actions/release-pr/action.yml b/.github/actions/release-pr/action.yml
index 8e3133b..a3f9df1 100644
--- a/.github/actions/release-pr/action.yml
+++ b/.github/actions/release-pr/action.yml
@@ -55,7 +55,7 @@ runs:
     # Rust is incidental here, so provision a toolchain rather than requiring
     # one from the caller. Empty `rustflags` so the install doesn't fail on
     # `-D warnings`.
-    - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+    - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         cache: false
         matcher: false
diff --git a/.github/actions/typos/action.yml b/.github/actions/typos/action.yml
index 3aee514..122de33 100644
--- a/.github/actions/typos/action.yml
+++ b/.github/actions/typos/action.yml
@@ -17,7 +17,7 @@ runs:
     # Rust is incidental here, so provision a toolchain rather than requiring
     # one from the caller. Empty `rustflags` so the install doesn't fail on
     # `-D warnings`.
-    - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+    - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         rustflags: ''
     - name: Install typos binary
diff --git a/.github/actions/unused-deps/action.yml b/.github/actions/unused-deps/action.yml
index 44cbb6f..951e19c 100644
--- a/.github/actions/unused-deps/action.yml
+++ b/.github/actions/unused-deps/action.yml
@@ -24,7 +24,7 @@ runs:
       if: inputs.packages != ''
       with:
         packages: "${{ inputs.packages }}"
-    - uses: taiki-e/install-action@c3ec0de9ae7f1019cea21aa96aa0a895b9552063 # v2.87.9
+    - uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2.87.19
       with:
         tool: cargo-udeps
     # Normally running cargo-udeps requires use of a nightly compiler
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 5b08e50..4351937 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       - name: Generate documentation
         env:
           RUSTDOCFLAGS: "--enable-index-page -Zunstable-options"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b9da006..1f9e234 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -86,7 +86,7 @@ jobs:
           persist-credentials: false
       - name: Generate fixture crate
         run: cargo init --lib --name fixture .
-      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
         with:
           # Don't save caches from test fixtures
           cache: false