diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index 17e9de89ba..f36fbff233 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -32,7 +32,7 @@ jobs:
       with:
         version: '1.16.5'
     - name: Run the benchmarks
-      uses: CodSpeedHQ/action@88472375d0a4572cf70a9f1fe3a4e0ab8da1b924 # v5.0.1
+      uses: CodSpeedHQ/action@0ca9cbbf4623b599a6c3ed4fc8a922942705d9f1 # v5.0.2
       env:
         ZARR_BENCHMARK_CLEAR_CACHE: '1'
       with:
diff --git a/.github/workflows/hypothesis.yaml b/.github/workflows/hypothesis.yaml
index cfe4477e52..dd49578dd0 100644
--- a/.github/workflows/hypothesis.yaml
+++ b/.github/workflows/hypothesis.yaml
@@ -109,7 +109,7 @@ jobs:
         && steps.status.outcome == 'failure'
         && github.event_name == 'schedule'
         && github.repository_owner == 'zarr-developers'
-      uses: scientific-python/issue-from-pytest-log-action@054799b34bd75a5fd6c86277a4a8a575224e60c6 # v1.6.1
+      uses: scientific-python/issue-from-pytest-log-action@35b4e0a9e06f8e7e261778289cf4b968b722662d # v1.6.2
       with:
         log-path: output-${{ matrix.python-version }}-log.jsonl
         issue-title: "Nightly Hypothesis tests failed"
diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index 759c443dd5..a08d5a6d3f 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -81,7 +81,7 @@ jobs:
           name: releases
           path: dist
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
       - name: Publish package to PyPI
diff --git a/.github/workflows/zarr-http-server-release.yml b/.github/workflows/zarr-http-server-release.yml
index b8940f7560..b78fa29ab7 100644
--- a/.github/workflows/zarr-http-server-release.yml
+++ b/.github/workflows/zarr-http-server-release.yml
@@ -82,7 +82,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
@@ -107,7 +107,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
diff --git a/.github/workflows/zarr-indexing-release.yml b/.github/workflows/zarr-indexing-release.yml
index de57594d2b..2c35abad9f 100644
--- a/.github/workflows/zarr-indexing-release.yml
+++ b/.github/workflows/zarr-indexing-release.yml
@@ -82,7 +82,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
@@ -107,7 +107,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
diff --git a/.github/workflows/zarr-metadata-release.yml b/.github/workflows/zarr-metadata-release.yml
index f9516ead71..17c285ded6 100644
--- a/.github/workflows/zarr-metadata-release.yml
+++ b/.github/workflows/zarr-metadata-release.yml
@@ -82,7 +82,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
@@ -107,7 +107,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 9022c56455..c90ba718f6 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -32,4 +32,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2