diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 08934c0..8ff939c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -37,7 +37,7 @@ jobs:
       - run: uv sync --locked
       # Runs the hooks from .pre-commit-config.yaml rather than repeating them
       # here, so local and CI cannot drift.
-      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204  # v3.0.1
+      - uses: j178/prek-action@44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d  # v3.1.0
         env:
           # renovate: datasource=github-releases depName=j178/prek extractVersion=^v(?<version>.+)$
           PREK_VERSION: 0.5.6
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 30202cf..dc88761 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -281,4 +281,4 @@ jobs:
         with:
           enable-cache: false
       - run: uv build
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3