diff --git a/.github/workflows/ack.yml b/.github/workflows/ack.yml
index caf113d..b66d1be 100644
--- a/.github/workflows/ack.yml
+++ b/.github/workflows/ack.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: auto-add labels
         if: github.event.issue.labels.length == 0
-        uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7
+        uses: release-drafter/release-drafter@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7
         with:
           # we only want to use the auto-labeler bits:
           disable-autolabeler: false
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index bba8929..044eaf7 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -10,4 +10,4 @@ on:
 
 jobs:
   ack:
-    uses: ansible/team-devtools/.github/workflows/push.yml@a7f2500fb428f217418c6c39c016319cd76df408 # main
+    uses: ansible/team-devtools/.github/workflows/push.yml@442c6e78fb5e45c2eab4904720db50d1e67a8dc9 # main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c32d87d..c8a0c80 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
 
       - name: Check out src from Git
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -31,7 +31,7 @@ jobs:
       - name: Attach dists to the release
         if: github.event_name == 'release'
         # cspell: ignore softprops
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           name: ${{ github.event.release.tag_name }}
           files: dist/*
diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
index 98f7044..01d5bd0 100644
--- a/.github/workflows/tox.yml
+++ b/.github/workflows/tox.yml
@@ -41,7 +41,7 @@ jobs:
 
       - name: Determine matrix
         id: generate_matrix
-        uses: ansible/actions/matrix@96828a1bedeacf72afaf583aa9fd1003e5a34cb5 # v1
+        uses: ansible/actions/matrix@b2b0657c2e1d083cf979eba2fd04ae79e5ab3900 # v1
         with:
           min_python: "3.11"
           default_python: |
@@ -168,7 +168,7 @@ jobs:
 
       - name: Archive logs
         if: always()
-        uses: ansible/actions/upload-artifact@9048781436578c05be457b94e2fc7981c67674b5 # main
+        uses: ansible/actions/upload-artifact@e74f61f91f99ce22066869886a485e5507f2ddb4 # main
         with:
           name: logs-${{ matrix.name }}.zip
           include-hidden-files: true
@@ -213,7 +213,7 @@ jobs:
 
       - name: Merge logs into a single archive
         if: ${{ needs.build.result != 'skipped' }}
-        uses: actions/upload-artifact/merge@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: logs.zip
           include-hidden-files: true
@@ -244,7 +244,7 @@ jobs:
           jobs: ${{ toJSON(needs) }}
 
       - name: Delete Merged Artifacts
-        uses: actions/upload-artifact/merge@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           include-hidden-files: true
           delete-merged: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 826bb54..a9d43cb 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,7 +18,7 @@ repos:
       - id: check-useless-excludes
         priority: 0
   - repo: https://github.com/ansible/actions
-    rev: v1.1.0
+    rev: v1.1.2
     hooks:
       - id: toml
         priority: 0
@@ -35,7 +35,7 @@ repos:
       - id: renovate-config-validator
         priority: 0
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.11.2
+    rev: 0.11.7
     hooks:
       - id: uv-sync
       - id: uv-lock
@@ -44,7 +44,7 @@ repos:
         args: ["--upgrade"]
         stages: [manual]
   - repo: https://github.com/biomejs/pre-commit
-    rev: "v2.4.9"
+    rev: "v2.4.13"
     hooks:
       - id: biome-check
         name: biome