diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 20f6ac5f2..b5b4ed4c7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -63,7 +63,7 @@ jobs:
         token: ${{ steps.generate-token.outputs.token }}
 
     - name: Setup Pixi
-      uses: prefix-dev/setup-pixi@v0.10.1
+      uses: prefix-dev/setup-pixi@v0.10.2
       with:
         pixi-version: v0.68.1
         cache: true
diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml
index 518931b8f..3e504d88c 100644
--- a/.github/workflows/security-scan.yaml
+++ b/.github/workflows/security-scan.yaml
@@ -41,12 +41,12 @@ jobs:
         shell: bash -l {0}
     steps:
     - uses: actions/checkout@v7
-    - uses: prefix-dev/setup-pixi@v0.10.1
+    - uses: prefix-dev/setup-pixi@v0.10.2
       with:
         pixi-version: v0.68.1
 
     - name: Generate SBOM
-      uses: anchore/sbom-action@v0.24.0
+      uses: anchore/sbom-action@v0.24.2
       with:
         path: ".pixi/envs/default"
         output-file: sbom.spdx.json
@@ -55,7 +55,7 @@ jobs:
 
     - name: Vulnerability Scan
       id: scan
-      uses: anchore/scan-action@v7.4.0
+      uses: anchore/scan-action@v7.4.2
       env:
         SBOM: sbom.spdx.json
       with: &scan_settings
@@ -95,7 +95,7 @@ jobs:
     # All PRs gate on new CVEs vs the master baseline
     - name: Download master baseline
       if: github.event_name == 'pull_request'
-      uses: dawidd6/action-download-artifact@v23
+      uses: dawidd6/action-download-artifact@v24
       with:
         workflow: security-scan.yaml
         name: master-sbom
@@ -106,7 +106,7 @@ jobs:
     - name: Scan master baseline
       id: baseline
       if: github.event_name == 'pull_request'
-      uses: anchore/scan-action@v7.4.0
+      uses: anchore/scan-action@v7.4.2
       env:
         SBOM: master-baseline/sbom.spdx.json
       with: *scan_settings
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 349a93dcb..f93e069db 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -29,7 +29,7 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: Setup Pixi
-      uses: prefix-dev/setup-pixi@v0.10.1
+      uses: prefix-dev/setup-pixi@v0.10.2
       with:
         pixi-version: v0.68.1
         cache: true
@@ -86,7 +86,7 @@ jobs:
 
     - name: Setup Pixi
       if: steps.filter.outputs.src == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-      uses: prefix-dev/setup-pixi@v0.10.1
+      uses: prefix-dev/setup-pixi@v0.10.2
       with:
         pixi-version: v0.68.1
         cache: true
diff --git a/.github/workflows/update-lockfile.yaml b/.github/workflows/update-lockfile.yaml
index bbe470cc1..b24f35f95 100644
--- a/.github/workflows/update-lockfile.yaml
+++ b/.github/workflows/update-lockfile.yaml
@@ -19,7 +19,7 @@ jobs:
     - uses: actions/checkout@v7
 
     - name: Setup Pixi
-      uses: prefix-dev/setup-pixi@v0.10.1
+      uses: prefix-dev/setup-pixi@v0.10.2
       with:
         pixi-version: v0.68.1