diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 90cac66..73b5671 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -19,13 +19,13 @@ jobs:
       contents: read # checkout the repo
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           persist-credentials: false
 
       - name: Install a specific version of uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           # Caching is disabled: this workflow can publish (tag trigger), and a
           # cache poisoned by a lower-privilege run could taint the built docs.
@@ -53,7 +53,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # Full history is needed so mike can fetch and update gh-pages.
           fetch-depth: 0
@@ -63,7 +63,7 @@ jobs:
           persist-credentials: false
 
       - name: Install a specific version of uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           # Caching is disabled: this workflow can publish (tag trigger), and a
           # cache poisoned by a lower-privilege run could taint the built docs.