diff --git a/.github/workflows/draft-paper.yaml b/.github/workflows/draft-paper.yaml
index 5a13372..a4ebd39 100644
--- a/.github/workflows/draft-paper.yaml
+++ b/.github/workflows/draft-paper.yaml
@@ -19,7 +19,7 @@ jobs:
           # This should be the path to the paper within your repo.
           paper-path: joss/paper.md
       - name: Upload
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: paper
           # This is the output path where Pandoc will write the compiled
diff --git a/.github/workflows/github_release.yml b/.github/workflows/github_release.yml
index 7930c58..aefb8e0 100644
--- a/.github/workflows/github_release.yml
+++ b/.github/workflows/github_release.yml
@@ -69,7 +69,7 @@ jobs:
         run: echo "NEWNAME=$(./utilities/rename-package.R *.tar.gz)" >> "$GITHUB_ENV"
       - name: Attest builds
         id: attest_build
-        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: ${{ env.NEWNAME }}
       - name: debug
diff --git a/.github/workflows/pkgdown.yml b/.github/workflows/pkgdown.yml
index 4ea6f72..353eba5 100644
--- a/.github/workflows/pkgdown.yml
+++ b/.github/workflows/pkgdown.yml
@@ -37,10 +37,10 @@ jobs:
       - name: Build pkgdown site
         run: Rscript -e 'pkgdown::build_site_github_pages(install = TRUE)'
       - name: Deploy pkgdown site
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: docs/
       - name: Deploy pkgdown site
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-coverage.yaml b/.github/workflows/test-coverage.yaml
index 5bda078..846a0b5 100644
--- a/.github/workflows/test-coverage.yaml
+++ b/.github/workflows/test-coverage.yaml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage-test-failures
           path: ${{ runner.temp }}/package
diff --git a/.github/workflows/test-coverage.yml b/.github/workflows/test-coverage.yml
index ed392e0..9d93115 100644
--- a/.github/workflows/test-coverage.yml
+++ b/.github/workflows/test-coverage.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-test-failures
           path: ${{ runner.temp }}/package