diff --git a/.github/workflows/bench-pr.yml b/.github/workflows/bench-pr.yml
index dda87c1c..ba2da11a 100644
--- a/.github/workflows/bench-pr.yml
+++ b/.github/workflows/bench-pr.yml
@@ -718,7 +718,7 @@ jobs:
 
       - name: Upload table
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: table-${{ env.LABEL }}
           path: out/table-${{ env.LABEL }}.md
@@ -764,7 +764,7 @@ jobs:
           build: false
           use-github-cache: false
       - name: Download tables
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: tables
           pattern: table-*
@@ -780,7 +780,7 @@ jobs:
             --head "$HEAD_SHA" \
             --repo-url "${{ github.server_url }}/${{ github.repository }}" \
             --run-id "${{ github.run_id }}" --out comment-body.md
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: comment-body
           path: comment-body.md
@@ -798,7 +798,7 @@ jobs:
       - name: Download comment body
         if: needs.assemble.result == 'success'
         continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: comment-body
       # A failed stage prepends a warning header to the report (quoting
diff --git a/.github/workflows/bencher-plots.yml b/.github/workflows/bencher-plots.yml
index 5f8d9535..5493b209 100644
--- a/.github/workflows/bencher-plots.yml
+++ b/.github/workflows/bencher-plots.yml
@@ -46,7 +46,7 @@ jobs:
           auto-config: false
           build: false
           use-github-cache: false
-      - uses: bencherdev/bencher@v0.6.8
+      - uses: bencherdev/bencher@v0.6.11
       # Plot create/delete needs those permissions on the ix project: a
       # user-scoped `bencher_user_*` key (the report-upload token the bench
       # workflows use may be run-scoped and unable to manage plots).
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 12d67a36..805f2e14 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Compile nataddcomm.ixe
         run: lake exe ix compile Ix.lean --consts Nat.add_comm --out nataddcomm.ixe
       - name: Upload nataddcomm.ixe
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: nataddcomm-ixe
           path: nataddcomm.ixe
@@ -147,7 +147,7 @@ jobs:
           # ELF embed accordingly, so this lints host code only.
           cargo clippy --release --workspace --all-targets -- -D warnings
       - name: Download nataddcomm.ixe
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: nataddcomm-ixe
           path: .
@@ -187,7 +187,7 @@ jobs:
           # ELFs its build scripts already produced).
           cargo clippy --release --workspace --all-targets -- -D warnings
       - name: Download nataddcomm.ixe
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: nataddcomm-ixe
           path: .
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d687151a..a41150f4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
     steps:
       # paths-filter diffs the PR via the API on pull_request events, but
       # needs a checkout to resolve the pushed commit range on push events.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - uses: dorny/paths-filter@v4
@@ -60,14 +60,14 @@ jobs:
       security-events: write
       packages: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.4
         with:
           languages: actions
           build-mode: none
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:actions"
 
@@ -81,14 +81,14 @@ jobs:
       security-events: write
       packages: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.4
         with:
           languages: rust
           build-mode: none
           dependency-caching: true
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.4
         with:
           category: "/language:rust"