diff --git a/.github/workflows/build-python-dists.yml b/.github/workflows/build-python-dists.yml
index 7ae1b36..c249024 100644
--- a/.github/workflows/build-python-dists.yml
+++ b/.github/workflows/build-python-dists.yml
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false  # don"t persist git credentials on disk
           ref: ${{ inputs.ref == null && null || inputs.ref }}
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ inputs.python-version }}
       - name: Install build dependencies
diff --git a/.github/workflows/ci-django-api.yml b/.github/workflows/ci-django-api.yml
index 91a8df2..3f627b3 100644
--- a/.github/workflows/ci-django-api.yml
+++ b/.github/workflows/ci-django-api.yml
@@ -80,7 +80,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Setup Python ${{ inputs.python-version }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Run pre-commit
@@ -144,12 +144,12 @@ jobs:
         run: |
           sudo apt-get install gdal-bin
       - name: Setup Python ${{ inputs.python-version }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip
       - name: Cache pip packages
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         env:
           cache-name: cache-pip-modules
         with:
@@ -178,7 +178,7 @@ jobs:
         run: |
           pytest -ra -vvv --cov=. --cov-report=xml
       - name: Store coverage.xml
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.working-directory && format('{0}/', inputs.working-directory) || ''}}coverage.xml
           key: cache-${{ github.run_id }}-${{ github.run_attempt }}
@@ -199,7 +199,7 @@ jobs:
         fetch-depth: 0
         persist-credentials: false
     - name: Restore coverage.xml
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ inputs.working-directory && format('{0}/', inputs.working-directory) || ''}}coverage.xml
         key: cache-${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/ci-node.yml b/.github/workflows/ci-node.yml
index 49e8f7f..926f90e 100644
--- a/.github/workflows/ci-node.yml
+++ b/.github/workflows/ci-node.yml
@@ -201,7 +201,7 @@ jobs:
     # Resolves the effective directory (app-directory if set, else working-directory),
     # then prefixes 'coverage' with '<dir>/' when running in a subdirectory.
     - name: Store coverage report
-      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ (inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) && format('{0}/', inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) || ''}}coverage
         key: cache-${{ github.run_id }}-${{ github.run_attempt }}
@@ -223,7 +223,7 @@ jobs:
     # Resolves the effective directory (app-directory if set, else working-directory),
     # then prefixes 'coverage' with '<dir>/' when running in a subdirectory.
     - name: Restore coverage report
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ (inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) && format('{0}/', inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) || ''}}coverage
         key: cache-${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/ci-pnpm-node.yml b/.github/workflows/ci-pnpm-node.yml
index c102dee..3a654f2 100644
--- a/.github/workflows/ci-pnpm-node.yml
+++ b/.github/workflows/ci-pnpm-node.yml
@@ -208,7 +208,7 @@ jobs:
       # Resolves the effective directory (app-directory if set, else working-directory),
       # then prefixes 'coverage' with '<dir>/' when running in a subdirectory.
       - name: Store coverage report
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ (inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) && format('{0}/', inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) || ''}}coverage
           key: cache-${{ github.run_id }}-${{ github.run_attempt }}
@@ -231,7 +231,7 @@ jobs:
       # Resolves the effective directory (app-directory if set, else working-directory),
       # then prefixes 'coverage' with '<dir>/' when running in a subdirectory.
       - name: Restore coverage report
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ (inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) && format('{0}/', inputs.app-directory == '.' && inputs.working-directory || inputs.app-directory) || ''}}coverage
           key: cache-${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/ci-python-library.yml b/.github/workflows/ci-python-library.yml
index c3f542b..469ea09 100644
--- a/.github/workflows/ci-python-library.yml
+++ b/.github/workflows/ci-python-library.yml
@@ -65,7 +65,7 @@ jobs:
         persist-credentials: false
 
     - name: Setup Python ${{ inputs.python-version }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -87,12 +87,12 @@ jobs:
         persist-credentials: false
 
     - name: Set up Python ${{ matrix.python_version }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ matrix.python_version }}
 
     - name: Set up pip cache
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       env:
         cache-name: cache-pip-modules
       with:
diff --git a/.github/workflows/ci-uv-django-api.yml b/.github/workflows/ci-uv-django-api.yml
index 7dda156..4860c1f 100644
--- a/.github/workflows/ci-uv-django-api.yml
+++ b/.github/workflows/ci-uv-django-api.yml
@@ -80,7 +80,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Setup Python ${{ inputs.python-version }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Run pre-commit
@@ -167,7 +167,7 @@ jobs:
         run: |
           uv run pytest -ra -vvv --cov=. --cov-report=xml
       - name: Store coverage.xml
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.working-directory && format('{0}/', inputs.working-directory) || ''}}coverage.xml
           key: cache-${{ github.run_id }}-${{ github.run_attempt }}
@@ -188,7 +188,7 @@ jobs:
         fetch-depth: 0
         persist-credentials: false
     - name: Restore coverage.xml
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ inputs.working-directory && format('{0}/', inputs.working-directory) || ''}}coverage.xml
         key: cache-${{ github.run_id }}-${{ github.run_attempt }}