diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 72fb9594dc..2abc5ebbef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,10 +96,10 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
         allow-prereleases: true
@@ -225,7 +225,7 @@ jobs:
     timeout-minutes: 40
     container: quay.io/pypa/musllinux_1_2_x86_64:latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -266,7 +266,7 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python-version }} (deadsnakes)
       uses: deadsnakes/action@v3.2.0
@@ -366,7 +366,7 @@ jobs:
     container: "silkeh/clang:${{ matrix.clang }}${{ matrix.container_suffix }}"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add wget and python3
       run: apt-get update && apt-get install -y python3-dev python3-numpy python3-pytest libeigen3-dev
@@ -400,7 +400,7 @@ jobs:
     container: nvidia/cuda:12.2.0-devel-ubuntu22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # tzdata will try to ask for the timezone, so set the DEBIAN_FRONTEND
     - name: Install 🐍 3
@@ -424,7 +424,7 @@ jobs:
 #    container: centos:8
 #
 #    steps:
-#    - uses: actions/checkout@v4
+#    - uses: actions/checkout@v5
 #
 #    - name: Add Python 3 and a few requirements
 #      run: yum update -y && yum install -y git python3-devel python3-numpy python3-pytest make environment-modules
@@ -469,7 +469,7 @@ jobs:
       # tzdata will try to ask for the timezone, so set the DEBIAN_FRONTEND
       DEBIAN_FRONTEND: 'noninteractive'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add NVHPC Repo
       run: |
@@ -529,7 +529,7 @@ jobs:
     container: "gcc:${{ matrix.gcc }}"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add Python 3
       run: apt-get update; apt-get install -y python3-dev python3-numpy python3-pytest python3-pip libeigen3-dev
@@ -587,7 +587,7 @@ jobs:
     name: "🐍 3 • ICC latest • x64"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add apt repo
       run: |
@@ -690,7 +690,7 @@ jobs:
 
     steps:
     - name: Latest actions/checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Add Python 3.8
       if: matrix.container == 'almalinux:8'
@@ -743,7 +743,7 @@ jobs:
     container: i386/debian:bullseye
 
     steps:
-    - uses: actions/checkout@v1  # v1 is required to run inside docker
+    - uses: actions/checkout@v5  # v1 is required to run inside docker
 
     - name: Install requirements
       run: |
@@ -786,9 +786,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
 
@@ -843,10 +843,10 @@ jobs:
     runs-on: windows-2019
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
         architecture: x86
@@ -896,10 +896,10 @@ jobs:
     runs-on: windows-2019
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
         architecture: x86
@@ -944,10 +944,10 @@ jobs:
     runs-on: windows-2022
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
 
@@ -1030,7 +1030,7 @@ jobs:
           mingw-w64-${{matrix.env}}-python-scipy
           mingw-w64-${{matrix.env}}-eigen3
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Configure C++11
       # LTO leads to many undefined reference like
@@ -1110,13 +1110,13 @@ jobs:
         run: env
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Clang
         uses: egor-tensin/setup-clang@v1
 
       - name: Setup Python ${{ matrix.python }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
 
@@ -1124,7 +1124,7 @@ jobs:
         uses: jwlawson/actions-setup-cmake@v2.0
 
       - name: Install ninja-build tool
-        uses: seanmiddleditch/gha-setup-ninja@v5
+        uses: seanmiddleditch/gha-setup-ninja@v6
 
       - name: Run pip installs
         run: |
@@ -1179,7 +1179,7 @@ jobs:
         run: env
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Show Clang++ version before brew install llvm
         run: clang++ --version
diff --git a/.github/workflows/configure.yml b/.github/workflows/configure.yml
index 2031ec8236..d1b5eb0421 100644
--- a/.github/workflows/configure.yml
+++ b/.github/workflows/configure.yml
@@ -49,10 +49,10 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python 3.8
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: 3.8
         architecture: ${{ matrix.arch }}
diff --git a/.github/workflows/emscripten.yaml b/.github/workflows/emscripten.yaml
index 5eac089e5c..20bce9114f 100644
--- a/.github/workflows/emscripten.yaml
+++ b/.github/workflows/emscripten.yaml
@@ -17,12 +17,12 @@ jobs:
     name: Pyodide wheel
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         submodules: true
         fetch-depth: 0
 
-    - uses: pypa/cibuildwheel@v2.22
+    - uses: pypa/cibuildwheel@v3.1
       env:
         PYODIDE_BUILD_EXPORTS: whole_archive
       with:
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index e50dc0bb72..cc71eb6bcf 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -25,8 +25,8 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@v5
+    - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
     - name: Add matchers
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     container: silkeh/clang:18-bookworm
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install requirements
       run: apt-get update && apt-get install -y git python3-dev python3-pytest
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 2152abbcf9..f5b618ba82 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
 
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       if: >
         github.event.pull_request.merged == true &&
         !startsWith(github.event.pull_request.title, 'chore(deps):') &&
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index c50f06f945..1aee84c406 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -27,10 +27,10 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup 🐍 3.8
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: 3.8
 
@@ -49,10 +49,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup 🐍 3.8
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: 3.8
 
@@ -100,10 +100,10 @@ jobs:
 
     steps:
     # Downloads all to directories matching the artifact names
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@v5
 
     - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@c4fbc648846ca6f503a13a2281a5e7b98aa57202 # v2.0.1
+      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
       with:
         subject-path: "*/pybind11*"
 
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 3892600381..edc09f51e2 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -24,10 +24,10 @@ jobs:
     if: "contains(github.event.pull_request.labels.*.name, 'python dev')"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python 3.13
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.13"
         allow-prereleases: true