diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 22caf6b95e..edfdfb4f24 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python }}
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version-file: uv.lock
           enable-cache: true
@@ -117,7 +117,7 @@ jobs:
             pre-commit-uv-${{ runner.os }}-
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version-file: uv.lock
           enable-cache: true
@@ -176,7 +176,7 @@ jobs:
           python-version: ${{ matrix.python }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version-file: uv.lock
           cache-dependency-glob: |
@@ -207,7 +207,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: Publish Pytest Results
-        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
+        uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d # v2.25.0
         if: (success() || failure()) && runner.os == 'Linux'
         with:
           check_name: Pytest (${{ matrix.python }}, ${{ matrix.package_extras }})
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8c7a056d5a..c2987bf964 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,14 +37,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: none
 
       - name: Perform CodeQL Analysis
         id: analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"
           # A literal value is required by the action's failed-analysis diagnostic recovery.
@@ -53,7 +53,7 @@ jobs:
 
       - name: Publish CodeQL results
         if: github.event_name != 'merge_group'
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: ${{ runner.temp }}/codeql-upload/upload.sarif
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/diff_cover.yml b/.github/workflows/diff_cover.yml
index e2b00087a6..ea306854f1 100644
--- a/.github/workflows/diff_cover.yml
+++ b/.github/workflows/diff_cover.yml
@@ -36,7 +36,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version-file: uv.lock
           enable-cache: true
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b73f6e539d..752b88ba0a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -87,7 +87,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.9.17"
           enable-cache: false
@@ -149,7 +149,7 @@ jobs:
 
       - name: Install uv
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           # Older release lockfiles do not include uv as a dependency.
           version: "0.9.17"
@@ -231,7 +231,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version: "0.9.17"
           enable-cache: false
diff --git a/.github/workflows/frontend_tests.yml b/.github/workflows/frontend_tests.yml
index c43910699f..1388b0dd48 100644
--- a/.github/workflows/frontend_tests.yml
+++ b/.github/workflows/frontend_tests.yml
@@ -111,7 +111,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           version-file: uv.lock
           enable-cache: true
diff --git a/tests/unit/build_scripts/test_codeql_merge_group.py b/tests/unit/build_scripts/test_codeql_merge_group.py
index 08be155345..f6be8d6054 100644
--- a/tests/unit/build_scripts/test_codeql_merge_group.py
+++ b/tests/unit/build_scripts/test_codeql_merge_group.py
@@ -13,7 +13,7 @@
 import yaml
 
 REPO_ROOT = Path(__file__).resolve().parents[3]
-CODEQL_PIN = "2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2"
+CODEQL_PIN = "24c54180a607b1449ed407dd24f251e4e9147c8d"
 
 
 @pytest.fixture(scope="module")