diff --git a/.github/workflows/benchmarks_report.yml b/.github/workflows/benchmarks_report.yml
index 24ff5a5094..9de947853e 100644
--- a/.github/workflows/benchmarks_report.yml
+++ b/.github/workflows/benchmarks_report.yml
@@ -83,7 +83,7 @@ jobs:
     if: needs.download.outputs.reports_exist == 1
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
@@ -95,7 +95,7 @@ jobs:
 
       - name: Set up Python
         # benchmarks/bm_runner.py only needs builtins to run.
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
 
       - name: Post reports
         env:
diff --git a/.github/workflows/benchmarks_run.yml b/.github/workflows/benchmarks_run.yml
index 302140d6fb..fc322dc6f6 100644
--- a/.github/workflows/benchmarks_run.yml
+++ b/.github/workflows/benchmarks_run.yml
@@ -37,7 +37,7 @@ jobs:
       overnight: ${{ steps.overnight.outputs.check }}
       branch: ${{ steps.branch.outputs.check }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -81,7 +81,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/benchmarks_validate.yml b/.github/workflows/benchmarks_validate.yml
index c216b0f41a..56a5787872 100644
--- a/.github/workflows/benchmarks_validate.yml
+++ b/.github/workflows/benchmarks_validate.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/ci-citation.yml b/.github/workflows/ci-citation.yml
index ae9dff0160..19562bf6f3 100644
--- a/.github/workflows/ci-citation.yml
+++ b/.github/workflows/ci-citation.yml
@@ -26,7 +26,7 @@ jobs:
     name: "validate"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/ci-linkchecks.yml b/.github/workflows/ci-linkchecks.yml
index 515338b805..b86f292ac3 100644
--- a/.github/workflows/ci-linkchecks.yml
+++ b/.github/workflows/ci-linkchecks.yml
@@ -21,14 +21,14 @@ jobs:
       issues: write # required for peter-evans/create-issue-from-file
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           fail: false
diff --git a/.github/workflows/ci-manifest.yml b/.github/workflows/ci-manifest.yml
index fe51d85456..3f445a8e70 100644
--- a/.github/workflows/ci-manifest.yml
+++ b/.github/workflows/ci-manifest.yml
@@ -26,4 +26,4 @@ permissions: {}
 jobs:
   manifest:
     name: "check-manifest"
-    uses: scitools/workflows/.github/workflows/ci-manifest.yml@1f2141422a63321a32575ddd186e53acff12550c
+    uses: scitools/workflows/.github/workflows/ci-manifest.yml@7c41342d8285bc7747b6f7bc4cd2639cdcbb017a
diff --git a/.github/workflows/ci-template-check.yml b/.github/workflows/ci-template-check.yml
index 300328cf56..1d208b9a11 100644
--- a/.github/workflows/ci-template-check.yml
+++ b/.github/workflows/ci-template-check.yml
@@ -12,7 +12,7 @@ permissions: {}
 
 jobs:
   prompt-share:
-    uses: scitools/workflows/.github/workflows/ci-template-check.yml@1f2141422a63321a32575ddd186e53acff12550c
+    uses: scitools/workflows/.github/workflows/ci-template-check.yml@7c41342d8285bc7747b6f7bc4cd2639cdcbb017a
     secrets:
       AUTH_APP_ID: ${{ secrets.AUTH_APP_ID }}
       AUTH_APP_PRIVATE_KEY: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 3696646d95..debecf7c29 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -59,7 +59,7 @@ jobs:
 
     steps:
       - name: "checkout"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/ci-wheels.yml b/.github/workflows/ci-wheels.yml
index 51429fd054..a0dffbbf6a 100644
--- a/.github/workflows/ci-wheels.yml
+++ b/.github/workflows/ci-wheels.yml
@@ -31,7 +31,7 @@ jobs:
     name: "build sdist & wheel"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -61,7 +61,7 @@ jobs:
     env:
       ENV_NAME: "ci-wheels"
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -147,7 +147,7 @@ jobs:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
 
-    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+    - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
@@ -169,6 +169,6 @@ jobs:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
 
-    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+    - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
       with:
         print-hash: true
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index e01f391a59..1b95c511e2 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -12,4 +12,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+    - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
diff --git a/.github/workflows/refresh-lockfiles.yml b/.github/workflows/refresh-lockfiles.yml
index cc6d38df9d..f4943fca73 100644
--- a/.github/workflows/refresh-lockfiles.yml
+++ b/.github/workflows/refresh-lockfiles.yml
@@ -16,7 +16,7 @@ permissions: {}
 
 jobs:
   refresh_lockfiles:
-    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@1f2141422a63321a32575ddd186e53acff12550c
+    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@7c41342d8285bc7747b6f7bc4cd2639cdcbb017a
     secrets:
       AUTH_APP_ID: ${{ secrets.AUTH_APP_ID }}
       AUTH_APP_PRIVATE_KEY: ${{ secrets.AUTH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 1949ba976c..ebe4e50255 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -26,7 +26,7 @@ jobs:
     if: "github.repository == 'SciTools/iris'"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}