diff --git a/.github/workflows/autofix.yaml b/.github/workflows/autofix.yaml
index 1ed0347..660026b 100644
--- a/.github/workflows/autofix.yaml
+++ b/.github/workflows/autofix.yaml
@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
           filter: blob:none
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
       - run: uv tool install hatch
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index dc8204c..84a61f0 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -87,7 +87,7 @@ jobs:
           uvx hatch run ${{ matrix.env.name }}:cov-report   # report visibly
           uvx hatch run ${{ matrix.env.name }}:coverage xml # create report for upload
       - name: Upload coverage
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           # Codecov answers "Repository not found" until scverse/scverse-doc is added there.
           # Flip back to true once it is.