diff --git a/.github/workflows/_pypi.yml b/.github/workflows/_pypi.yml
index 8032bba..fa78b9e 100644
--- a/.github/workflows/_pypi.yml
+++ b/.github/workflows/_pypi.yml
@@ -8,7 +8,7 @@ jobs:
 
     steps:
       - name: Download dist artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: dist
           path: dist
diff --git a/.github/workflows/_release.yml b/.github/workflows/_release.yml
index 3f949fc..dc336fe 100644
--- a/.github/workflows/_release.yml
+++ b/.github/workflows/_release.yml
@@ -7,7 +7,7 @@ jobs:
 
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           merge-multiple: true
 
@@ -23,7 +23,7 @@ jobs:
       - name: Create GitHub Release
         # We pin to the SHA, not the tag, for security reasons.
         # https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions
-        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
           prerelease: ${{ contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc') }}
           files: "*"