diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1e0736e..4a58e12 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,7 +44,7 @@ jobs:
           echo "OK: $fields entries tagged, $(echo "$used" | wc -l) topic ids used, all known"
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f  # v1.335.0
+        uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94  # v1.336.0
         with:
           ruby-version: "3.3"
           bundler-cache: true
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e8696ae..264f18c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f  # v1.335.0
+        uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94  # v1.336.0
         with:
           ruby-version: "3.3"
           bundler-cache: true
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index 77212a7..2b57017 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f  # v1.335.0
+        uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94  # v1.336.0
         with:
           ruby-version: "3.3"
           bundler-cache: true
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 4381e48..7aa960c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f  # v1.335.0
+        uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94  # v1.336.0
         with:
           ruby-version: "3.3"
           bundler-cache: true  # bundler-audit is locked in Gemfile.lock (group :audit)
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
 
       - name: Lint workflows
         # Same version as the pre-commit hook; bump both together.