diff --git a/.github/workflows/benchmarks_report.yml b/.github/workflows/benchmarks_report.yml
index 4a45da3704..e83f749649 100644
--- a/.github/workflows/benchmarks_report.yml
+++ b/.github/workflows/benchmarks_report.yml
@@ -65,7 +65,7 @@ jobs:
     if: needs.download.outputs.reports_exist == 1
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download artifact
         uses: actions/download-artifact@v8
@@ -75,7 +75,7 @@ jobs:
 
       - name: Set up Python
         # benchmarks/bm_runner.py only needs builtins to run.
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
 
       - name: Post reports
         env:
diff --git a/.github/workflows/benchmarks_run.yml b/.github/workflows/benchmarks_run.yml
index bfbf5a81f0..77afbc1867 100644
--- a/.github/workflows/benchmarks_run.yml
+++ b/.github/workflows/benchmarks_run.yml
@@ -29,7 +29,7 @@ jobs:
       overnight: ${{ steps.overnight.outputs.check }}
       branch: ${{ steps.branch.outputs.check }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2
       - id: files-changed
@@ -72,7 +72,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -81,7 +81,7 @@ jobs:
 
       - name: Cache environment directories
         id: cache-env-dir
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             .nox
@@ -91,7 +91,7 @@ jobs:
 
       - name: Cache test data directory
         id: cache-test-data
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.IRIS_TEST_DATA_PATH }}
diff --git a/.github/workflows/benchmarks_validate.yml b/.github/workflows/benchmarks_validate.yml
index 48f49bd0c4..965ce6c31d 100644
--- a/.github/workflows/benchmarks_validate.yml
+++ b/.github/workflows/benchmarks_validate.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -36,7 +36,7 @@ jobs:
 
       - name: Cache environment directories
         id: cache-env-dir
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             .nox
diff --git a/.github/workflows/ci-citation.yml b/.github/workflows/ci-citation.yml
index 26945289a9..1d2ef9ac09 100644
--- a/.github/workflows/ci-citation.yml
+++ b/.github/workflows/ci-citation.yml
@@ -20,7 +20,7 @@ jobs:
     name: "validate"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci-linkchecks.yml b/.github/workflows/ci-linkchecks.yml
index 6ffdd3df93..a6d934d943 100644
--- a/.github/workflows/ci-linkchecks.yml
+++ b/.github/workflows/ci-linkchecks.yml
@@ -16,14 +16,14 @@ jobs:
       issues: write # required for peter-evans/create-issue-from-file
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           fail: false
diff --git a/.github/workflows/ci-manifest.yml b/.github/workflows/ci-manifest.yml
index cde7c20f52..fb7e13e240 100644
--- a/.github/workflows/ci-manifest.yml
+++ b/.github/workflows/ci-manifest.yml
@@ -23,4 +23,4 @@ concurrency:
 jobs:
   manifest:
     name: "check-manifest"
-    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2026.05.0
+    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2026.07.1
diff --git a/.github/workflows/ci-template-check.yml b/.github/workflows/ci-template-check.yml
index 3475c14d25..9444f54d68 100644
--- a/.github/workflows/ci-template-check.yml
+++ b/.github/workflows/ci-template-check.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   prompt-share:
-    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2026.05.0
+    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2026.07.1
     secrets: inherit
     with:
       pr_number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 76b10d06c7..ac5cf940f7 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: "checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: "environment configure"
         env:
@@ -143,6 +143,6 @@ jobs:
 
       - name: "upload coverage report"
         if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/ci-wheels.yml b/.github/workflows/ci-wheels.yml
index 9da409f1f6..90d38af803 100644
--- a/.github/workflows/ci-wheels.yml
+++ b/.github/workflows/ci-wheels.yml
@@ -28,7 +28,7 @@ jobs:
     name: "build sdist & wheel"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
@@ -57,7 +57,7 @@ jobs:
     env:
       ENV_NAME: "ci-wheels"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
@@ -142,7 +142,7 @@ jobs:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
 
-    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+    - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
@@ -164,6 +164,6 @@ jobs:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
 
-    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+    - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
       with:
         print-hash: true
diff --git a/.github/workflows/composite/cartopy-cache/action.yml b/.github/workflows/composite/cartopy-cache/action.yml
index 800a19162b..bcc6387ee0 100644
--- a/.github/workflows/composite/cartopy-cache/action.yml
+++ b/.github/workflows/composite/cartopy-cache/action.yml
@@ -20,7 +20,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       id: cartopy-cache
       with:
         path: ~/.local/share/cartopy
diff --git a/.github/workflows/composite/conda-env-cache/action.yml b/.github/workflows/composite/conda-env-cache/action.yml
index 8be4e63f88..f746247744 100644
--- a/.github/workflows/composite/conda-env-cache/action.yml
+++ b/.github/workflows/composite/conda-env-cache/action.yml
@@ -23,7 +23,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       id: conda-env-cache
       with:
         path: ${{ env.CONDA }}/envs/${{ inputs.env_name }}
diff --git a/.github/workflows/composite/conda-pkg-cache/action.yml b/.github/workflows/composite/conda-pkg-cache/action.yml
index a6fd89762b..7b03c94173 100644
--- a/.github/workflows/composite/conda-pkg-cache/action.yml
+++ b/.github/workflows/composite/conda-pkg-cache/action.yml
@@ -16,7 +16,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       with:
         path: ~/conda_pkgs_dir
         key: ${{ runner.os }}-conda-pkgs-${{ inputs.env_name }}-p${{ inputs.cache_period }}-b${{ inputs.cache_build }}
diff --git a/.github/workflows/composite/iris-data-cache/action.yml b/.github/workflows/composite/iris-data-cache/action.yml
index 6d12a768fd..ec93295a7b 100644
--- a/.github/workflows/composite/iris-data-cache/action.yml
+++ b/.github/workflows/composite/iris-data-cache/action.yml
@@ -16,7 +16,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       id: data-cache
       with:
         path: ~/iris-test-data
diff --git a/.github/workflows/composite/nox-cache/action.yml b/.github/workflows/composite/nox-cache/action.yml
index f8249033df..129f3b84f8 100644
--- a/.github/workflows/composite/nox-cache/action.yml
+++ b/.github/workflows/composite/nox-cache/action.yml
@@ -16,7 +16,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       with:
         path: ${{ github.workspace }}/.nox
         key: ${{ runner.os }}-nox-${{ inputs.env_name }}-s${{ matrix.session }}-py${{ matrix.python-version }}-b${{ inputs.cache_build }}-${{ hashFiles(inputs.lock_file) }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index b25ce8691b..5e26168911 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -12,4 +12,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v6
\ No newline at end of file
+    - uses: actions/labeler@v7
\ No newline at end of file
diff --git a/.github/workflows/refresh-lockfiles.yml b/.github/workflows/refresh-lockfiles.yml
index df6929bdab..5efdf8965c 100644
--- a/.github/workflows/refresh-lockfiles.yml
+++ b/.github/workflows/refresh-lockfiles.yml
@@ -14,5 +14,5 @@ on:
 
 jobs:
   refresh_lockfiles:
-    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2026.05.0
+    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2026.07.1
     secrets: inherit