diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5695074..3f2bf0a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,13 @@ jobs:
         # pytest is needed so mypy can find its stubs when type-checking tests/.
         # numpy is an optional runtime dependency (#22 zero-copy path) but
         # mypy still needs its types when type-checking src/pyrewire/session.py.
-        run: pip install black isort flake8 mypy pytest numpy
+        # numpy is pinned <2.5 here: numpy 2.5.0 ships .pyi stubs that use the
+        # PEP 695 `type` statement, which mypy rejects under our `python_version
+        # = "3.11"` target (requires-python is >=3.11) with "Type statement is
+        # only supported in Python 3.12 and greater". This only affects the
+        # stub-checking env; runtime numpy stays unpinned (>=1.24). Drop the cap
+        # once mypy parses PEP 695 stubs independently of the target version.
+        run: pip install black isort flake8 mypy pytest "numpy<2.5"
       - name: black --check
         run: black --check .
       - name: isort --check
@@ -102,7 +108,7 @@ jobs:
       # matrix slot on the same OS.
       - name: cache wirelog install
         id: cache-wirelog
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ${{ env.WIRELOG_PREFIX }}
           key: wirelog-${{ matrix.os }}-${{ steps.wirelog-sha.outputs.sha }}-${{ hashFiles('scripts/build_wirelog.sh', 'scripts/build_wirelog.ps1') }}
diff --git a/tests/test_ci_workflow.py b/tests/test_ci_workflow.py
index e85435f..d2e14a5 100644
--- a/tests/test_ci_workflow.py
+++ b/tests/test_ci_workflow.py
@@ -48,7 +48,7 @@ def test_ci_uses_node24_actions():
     assert "ilammy/msvc-dev-cmd" not in text
     assert "actions/checkout@v7" in text
     assert "actions/setup-python@v6" in text
-    assert "actions/cache@v5" in text
+    assert "actions/cache@v6" in text
 
 
 def test_all_workflows_use_node24_core_actions():