diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index b9872f8e..8d194ec7 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -38,7 +38,7 @@ jobs:
         run: pip install -e .[test]
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@88472375d0a4572cf70a9f1fe3a4e0ab8da1b924 # v5.0.1
+        uses: CodSpeedHQ/action@4296e51e7041e24dadb86d1d6e8b9320d223dbe8 # v5.0.3
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
           run: pytest tests/ --codspeed
diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml
index bc8b9f65..ddf13283 100644
--- a/.github/workflows/publish-package.yml
+++ b/.github/workflows/publish-package.yml
@@ -37,7 +37,7 @@ jobs:
         twine check dist/commit_check*
 
     - name: Create attestations
-      uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
         subject-path: "dist/commit_check*"