diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 268c7d0..941b67b 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -73,7 +73,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: true # toolchain/components are specified in rust-toolchain.toml
           cache-bin: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f455a45..20d5f81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version-file: pyproject.toml
           python-version-file: .python-version
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index a5ee308..763179c 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.13.7"
           enable-cache: false
@@ -80,7 +80,7 @@ jobs:
     steps:
       # No checkout, local action, project environment or handoff code executes here.
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.13.7"
           enable-cache: false
diff --git a/.github/workflows/release-benchmarks.yml b/.github/workflows/release-benchmarks.yml
index 0c6e622..d7823f2 100644
--- a/.github/workflows/release-benchmarks.yml
+++ b/.github/workflows/release-benchmarks.yml
@@ -35,7 +35,7 @@ jobs:
       validated-attempt: ${{ github.run_attempt }}
     steps:
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.13.7"
           enable-cache: false
@@ -157,7 +157,7 @@ jobs:
     steps:
       # No checkout or repository code runs with attachment credentials.
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           version: "0.13.7"
           enable-cache: false