diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 336d84be..3c90eed8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           components: rustfmt, clippy
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         with:
           key: ${{ hashFiles('**/Cargo.lock') }}
 
diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml
index f349c50c..dead067c 100644
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@@ -8,7 +8,7 @@ jobs:
   validate-pr-title:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v3.2.0
+      - uses: actions/create-github-app-token@v3.3.0
         id: app-token
         with:
           app-id: ${{ secrets.DS_RELEASE_BOT_ID }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 00432ea9..0722735d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         with:
           key: ${{ hashFiles('**/Cargo.lock') }}
 
diff --git a/.github/workflows/rust-release-pyo3-bytes.yml b/.github/workflows/rust-release-pyo3-bytes.yml
index 5246b400..282d6fd1 100644
--- a/.github/workflows/rust-release-pyo3-bytes.yml
+++ b/.github/workflows/rust-release-pyo3-bytes.yml
@@ -13,7 +13,7 @@ jobs:
       id-token: write # Required for OIDC token exchange
     steps:
       - uses: actions/checkout@v7
-      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1
         id: auth
       - run: cargo publish --manifest-path pyo3-bytes/Cargo.toml
         env:
diff --git a/.github/workflows/rust-release-pyo3-object_store.yml b/.github/workflows/rust-release-pyo3-object_store.yml
index b430616e..295159d2 100644
--- a/.github/workflows/rust-release-pyo3-object_store.yml
+++ b/.github/workflows/rust-release-pyo3-object_store.yml
@@ -13,7 +13,7 @@ jobs:
       id-token: write # Required for OIDC token exchange
     steps:
       - uses: actions/checkout@v7
-      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1
         id: auth
       - run: cargo publish --manifest-path pyo3-object_store/Cargo.toml
         env:
diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
index cadd5ab6..86e08f61 100644
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         with:
           # rust-cache normalizes version numbers before hashing Cargo.lock,
           # so minor/patch dep bumps don't invalidate the cache. Append the