diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76fae05..bd5a8f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
           bun-version: 1.3.14
       # setup-uv stopped publishing floating major tags in v8, so this is pinned
       # to an exact release rather than a tracking `@v10`.
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # The document tools declare their dependencies with PEP 723 inline
           # metadata, so the default lockfile globs match no file and the cache
@@ -94,7 +94,7 @@ jobs:
           bun-version: 1.3.14
       # setup-uv stopped publishing floating major tags in v8, so this is pinned
       # to an exact release rather than a tracking `@v10`.
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # The document tools declare their dependencies with PEP 723 inline
           # metadata, so the default lockfile globs match no file and the cache
diff --git a/.github/workflows/ocr-review.yml b/.github/workflows/ocr-review.yml
index 2e19a4b..9260984 100644
--- a/.github/workflows/ocr-review.yml
+++ b/.github/workflows/ocr-review.yml
@@ -81,7 +81,7 @@ jobs:
       - name: Get PR context
         id: pr-context
         if: github.event_name == 'issue_comment'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             // issue_comment events have no top-level pull_request fields, so
@@ -96,7 +96,7 @@ jobs:
             core.setOutput('head_sha', pullRequest.head.sha);
 
       - name: Run OpenCodeReview
-        uses: alibaba/open-code-review@v1.9.9
+        uses: alibaba/open-code-review@v1.12.10
         with:
           llm_url: ${{ secrets.OCR_LLM_URL }}
           llm_auth_token: ${{ secrets.OCR_LLM_AUTH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c30a060..0ebb4b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,7 +48,7 @@ jobs:
           bun-version: 1.3.14
       # setup-uv stopped publishing floating major tags in v8, so this is pinned
       # to an exact release rather than a tracking `@v10`.
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # The document tools declare their dependencies with PEP 723 inline
           # metadata, so the default lockfile globs match no file and the cache
@@ -178,7 +178,7 @@ jobs:
           bun-version: 1.3.14
       # setup-uv stopped publishing floating major tags in v8, so this is pinned
       # to an exact release rather than a tracking `@v10`.
-      - uses: astral-sh/setup-uv@v10.0.1
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # The document tools declare their dependencies with PEP 723 inline
           # metadata, so the default lockfile globs match no file and the cache