diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d9d48888..34e3aace 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
         path: dist
 
     - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
+      uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
       with:
         subject-path: "dist/cibuildwheel-*"
 
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index a31aaf88..c22469df 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -32,7 +32,7 @@ jobs:
 
     - uses: actions/checkout@v4
 
-    - uses: wntrblm/nox@2025.02.09
+    - uses: wntrblm/nox@2025.05.01
 
     - name: "Run update: dependencies"
       run: nox --force-color -s update_constraints