diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d7ea350..c179790 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
           echo "OK: $fields entries tagged, $(echo "$used" | wc -l) topic ids used, all known"
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8  # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a  # v1.329.0
         with:
           ruby-version: "3.3"
           bundler-cache: true
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0696126..ab9630a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8  # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a  # v1.329.0
         with:
           ruby-version: "3.3"
           bundler-cache: true
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index 6f2c2bc..32cfc4f 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8  # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a  # v1.329.0
         with:
           ruby-version: "3.3"
           bundler-cache: true
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 8cc822f..0fc2fb0 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8  # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a  # v1.329.0
         with:
           ruby-version: "3.3"
           bundler-cache: true  # bundler-audit is locked in Gemfile.lock (group :audit)
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Lint workflows
         # Same version as the pre-commit hook; bump both together.