diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8eb1ef8..3b9fe6d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@v4.37.3
         with:
           languages: python
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@v4.37.3
diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml
index e2c27d0..109ff6e 100644
--- a/.github/workflows/desktop.yml
+++ b/.github/workflows/desktop.yml
@@ -75,10 +75,10 @@ jobs:
           version: "0.12.0"
           enable-cache: false
 
-      - uses: dtolnay/rust-toolchain@1.97.1
+      - uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Restore Rust build cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -110,7 +110,7 @@ jobs:
 
       - name: Restore the pinned uv sidecar
         id: uv-sidecar-cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: desktop/src-tauri/binaries
           key: desktop-uv-sidecar-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('desktop/sidecars.json') }}