diff --git a/.github/workflows/black.yaml b/.github/workflows/black.yaml
index b5d8efdc35..eb5e537094 100644
--- a/.github/workflows/black.yaml
+++ b/.github/workflows/black.yaml
@@ -30,6 +30,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e  # 26.5.1
+      - uses: psf/black@258e7dbf348bc23cb70b8cdf693481c04634ebcc  # 26.10.1
         with:
             version: "~= 24.0"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1c23b3e4e..0091055472 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -421,7 +421,7 @@ jobs:
 
     - name: Upload binaries (${{ matrix.binary }})
       if: ${{ matrix.binary && startsWith(github.ref, 'refs/tags/') }}
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: ${{ matrix.binary }}
         path: artifacts/*
@@ -800,7 +800,7 @@ jobs:
     - name: Upload binaries (${{ matrix.binary }})
       # Also for non-tag runs (without the attestation), so that the binary of
       # a PR or master build can be tried out on an older system.
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: ${{ matrix.binary }}
         path: artifacts/*
@@ -1122,7 +1122,7 @@ jobs:
 
       - name: Upload artifacts
         if: startsWith(github.ref, 'refs/tags/') && matrix.do_binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: ${{ matrix.artifact_prefix }}
           path: artifacts/*
@@ -1283,7 +1283,7 @@ jobs:
           Get-ChildItem artifacts
 
       - name: Upload binaries (borg-windows-x86_64-gh)
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: borg-windows-x86_64-gh
           path: artifacts/*
@@ -1369,7 +1369,7 @@ jobs:
 
     steps:
     - name: Get the sdist built by the release job
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
       with:
         name: sdist
         path: dist
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 34605006b4..41f029029a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -74,7 +74,7 @@ jobs:
         sudo apt-get install -y libssl-dev libacl1-dev liblz4-dev
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -88,4 +88,4 @@ jobs:
         pip3 install -r requirements.d/development.txt
         pip3 install -ve .
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 422d45b305..9d0eb6de8d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -146,7 +146,7 @@ jobs:
         cp "$BUNDLE_PATH" "dist/$sdist.sigstore.jsonl"
 
     - name: Download the binaries built for this tag
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
       with:
         path: assets
         # the binary artifacts are all named like the binaries they contain
@@ -229,7 +229,7 @@ jobs:
         gh release view "$TAG" --json isDraft,isPrerelease,assets
 
     - name: Keep the sdist for the PyPI upload
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: sdist
         path: dist/*.tar.gz