diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87cc00d..edac107 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           # Warnings are handled by CARGO_BUILD_WARNINGS above, which applies
           # to local packages only. The action defaults to `-D warnings`,
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 7829365..cd11d72 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -14,7 +14,7 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Mint a token from the GitHub App so the opened PR triggers CI; pushes
       # made with GITHUB_TOKEN do not. Same App as the org repo-sync workflows.