diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 219b44f..1793ab9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
       contents: 'read' # to check out the repository
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v6.1.0
         with: { ref: '${{ github.event.pull_request.head.sha }}' }
 
       - name: 'Setup Node.js'
@@ -88,7 +88,7 @@ jobs:
         with: { name: 'cobertura-report' }
 
       - name: 'Upload to code coverage API'
-        uses: actions/upload-code-coverage@v1.4.0
+        uses: actions/upload-code-coverage@v1.4.1
         with:
           file: 'cobertura-coverage.xml'
           language: 'TypeScript'
@@ -106,7 +106,7 @@ jobs:
         node: ['lts/hydrogen', 'lts/iron', 'lts/jod', 'lts/krypton']
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v6.1.0
         with: { ref: '${{ github.event.pull_request.head.sha }}' }
 
       - name: 'Setup Node.js'
@@ -138,7 +138,7 @@ jobs:
       contents: 'read' # to check out the repository
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v6.1.0
         with: { ref: '${{ github.event.pull_request.head.sha }}' }
 
       - name: 'Setup Node.js'
@@ -207,7 +207,7 @@ jobs:
       id-token: 'write' # OIDC: npm trusted publishing (token-free auth) + provenance
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v6.1.0
         with: { fetch-depth: '0', ref: '${{ github.event.pull_request.head.sha }}' }
 
       - name: 'Setup Node.js'