diff --git a/.github/actions/setup-env/action.yml b/.github/actions/setup-env/action.yml
index cbb76da..3a3e73b 100644
--- a/.github/actions/setup-env/action.yml
+++ b/.github/actions/setup-env/action.yml
@@ -114,7 +114,7 @@ runs:
         dir=$(cd "$(dirname "$manifest")" && { pwd -W 2>/dev/null || pwd; })
         echo "manifest=$dir/$(basename "$manifest")" >>"$GITHUB_OUTPUT"
 
-    - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2
       if: inputs.mode == 'library'
       with:
         pixi-version: ${{ inputs.pixi-version }}
@@ -165,7 +165,7 @@ runs:
         fi
         echo "run=$run" >>"$GITHUB_OUTPUT"
 
-    - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
+    - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2
       if: inputs.mode == 'project'
       with:
         pixi-version: ${{ inputs.pixi-version }}
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index a982f3a..3170333 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -83,7 +83,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+      - uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
         with:
           path: ${{ inputs.working-directory }}
           skip-sdist: true
@@ -134,7 +134,7 @@ jobs:
           vars-json: ${{ toJSON(vars) }}
           vars-env: ${{ inputs.vars-env }}
           working-directory: ${{ inputs.working-directory }}
-      - uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
+      - uses: CodSpeedHQ/action@821a40cd6c80e3cfe387caf55668287addd808da # v5.5.0
         env:
           BENCHMARK_PATH: ${{ inputs.benchmark-path }}
           PYTEST_ARGS: ${{ inputs.pytest-args }}
@@ -189,13 +189,13 @@ jobs:
           else
             echo "present=false" >> "$GITHUB_OUTPUT"
           fi
-      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+      - uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
         id: head-build
         with:
           path: head/${{ inputs.working-directory }}
           skip-sdist: true
           upload-name-suffix: -benchmark-head
-      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+      - uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
         id: base-build
         if: steps.base.outputs.present == 'true'
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e66d5c4..f6a1c5b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
         with:
           version: 0.13.0
       - run: uvx --from actionlint-py==1.7.12.25 actionlint
diff --git a/.github/workflows/pypsa-eur.yml b/.github/workflows/pypsa-eur.yml
index 5844a9d..1dbfa56 100644
--- a/.github/workflows/pypsa-eur.yml
+++ b/.github/workflows/pypsa-eur.yml
@@ -118,7 +118,7 @@ jobs:
           ref: ${{ inputs.pypsa-eur-ref }}
           path: pypsa-eur
           persist-credentials: false
-      - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
+      - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2
         if: steps.gate.outputs.run == 'true'
         with:
           pixi-version: v0.81.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aa980e4..94b2d5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,7 +130,7 @@ jobs:
         run: |
           set -euo pipefail
           [ "$(git rev-parse HEAD)" = "$COMMIT" ] || { echo "::error::$BRANCH has commits after $TAG. Tag the tip of $BRANCH."; exit 1; }
-      - uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
+      - uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2
         if: steps.check.outputs.prepared == 'false'
         with:
           pixi-version: v0.81.0
@@ -140,7 +140,7 @@ jobs:
         env:
           PREPARE_COMMAND: ${{ inputs.prepare-command }}
         run: bash -euo pipefail -c "$PREPARE_COMMAND"
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         if: steps.check.outputs.prepared == 'false'
         with:
@@ -236,7 +236,7 @@ jobs:
             echo "::error::tag $TAG not found"
             exit 1
           fi
-      - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+      - uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
         id: baipp
         with:
           path: ${{ inputs.working-directory }}
@@ -274,7 +274,7 @@ jobs:
         with:
           name: Packages-release
           path: dist
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true
@@ -393,4 +393,4 @@ jobs:
         with:
           name: Packages-release
           path: dist
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index daa9a6f..4ad1063 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -118,12 +118,12 @@ jobs:
           persist-credentials: false
       - id: baipp
         if: inputs.pixi-task == ''
-        uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1
+        uses: hynek/build-and-inspect-python-package@67230f7b8410ae0052b39c1efc89d89fff43ff10 # v3.0.2
         with:
           path: ${{ inputs.working-directory }}
           upload-name-suffix: ${{ inputs.artifact-suffix }}
       - if: inputs.pixi-task != '' && !startsWith(inputs.pixi-environments, '[')
-        uses: prefix-dev/setup-pixi@9dabb60412d3d2d967a8d682f7ce01317af40514 # v0.11.0
+        uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2
         with:
           pixi-version: ${{ inputs.pixi-version }}
           run-install: false