diff --git a/.github/workflows/deploy-gh-pages.yml b/.github/workflows/deploy-gh-pages.yml
index 7ead0e8..c26ac3a 100644
--- a/.github/workflows/deploy-gh-pages.yml
+++ b/.github/workflows/deploy-gh-pages.yml
@@ -55,7 +55,7 @@ jobs:
       # Same cache as the docs check: social cards and the external assets the
       # privacy plugin downloads, so a deploy does not re-fetch them.
       - name: Restore social card and external asset cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .cache
           key: mkdocs-material-${{ hashFiles('mkdocs.yml', 'docs/**') }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 34b0dd5..7482c5a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -38,7 +38,7 @@ jobs:
       # .cache. Without it every build re-fetches them, and a strict build
       # turns a single failed download into a build failure.
       - name: Restore social card and external asset cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .cache
           key: mkdocs-material-${{ hashFiles('mkdocs.yml', 'docs/**') }}
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 8f064d7..cb94faa 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: IsolationKernel/ikpykit