diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eaa1c2c0cd..38249e9206 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -179,7 +179,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6
@@ -255,7 +255,7 @@ jobs:
     timeout-minutes: 40
     container: ${{ matrix.container }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -293,7 +293,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python ${{ matrix.python-version }} (deadsnakes)
       uses: deadsnakes/action@v3.2.0
@@ -306,7 +306,7 @@ jobs:
 
     - name: Valgrind cache
       if: matrix.valgrind
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       id: cache-valgrind
       with:
         path: valgrind
@@ -382,7 +382,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Add wget and python3
       run: apt-get update && apt-get install -y python3-dev python3-numpy python3-pytest libeigen3-dev
@@ -421,7 +421,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     # tzdata will try to ask for the timezone, so set the DEBIAN_FRONTEND
     - name: Install 🐍 3
@@ -445,7 +445,7 @@ jobs:
 #    container: centos:8
 #
 #    steps:
-#    - uses: actions/checkout@v6
+#    - uses: actions/checkout@v7
 #
 #    - name: Add Python 3 and a few requirements
 #      run: yum update -y && yum install -y git python3-devel python3-numpy python3-pytest make environment-modules
@@ -492,7 +492,7 @@ jobs:
       # tzdata will try to ask for the timezone, so set the DEBIAN_FRONTEND
       DEBIAN_FRONTEND: 'noninteractive'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Clean out unused stuff to save space
       run: |
@@ -561,7 +561,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Add Python 3
       run: apt-get update; apt-get install -y python3-dev python3-numpy python3-pytest python3-pip libeigen3-dev
@@ -626,7 +626,7 @@ jobs:
     name: "🐍 3 • ICC latest • x64"
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Add apt repo
       run: |
@@ -742,7 +742,7 @@ jobs:
 
     steps:
     - name: Latest actions/checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Add Python 3.8
       if: matrix.container == 'almalinux:8'
@@ -802,7 +802,7 @@ jobs:
 
     steps:
     # v1 required for i386/debian container; pinned to SHA to prevent dependabot updates
-    - uses: actions/checkout@544eadc6bf3d226fd7a7a9f0dc5b5bf7ca0675b9  # v1
+    - uses: actions/checkout@4f1f4aec02e41874fa0262ea8ff5172d7978ad1e  # v1
 
     - name: Install requirements
       run: |
@@ -847,7 +847,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - uses: actions/setup-python@v6
       with:
@@ -894,7 +894,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python ${{ matrix.python }}
       uses: actions/setup-python@v6
@@ -947,7 +947,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python ${{ matrix.python }}
       uses: actions/setup-python@v6
@@ -996,7 +996,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python ${{ matrix.python }}
       uses: actions/setup-python@v6
@@ -1084,7 +1084,7 @@ jobs:
           mingw-w64-${{matrix.env}}-catch
           ${{ matrix.extra_install }}
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Configure C++11
       # LTO leads to many undefined reference like
@@ -1178,7 +1178,7 @@ jobs:
         run: env
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Clang
         uses: egor-tensin/setup-clang@v2
@@ -1255,7 +1255,7 @@ jobs:
         run: env
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Python ${{ matrix.python }}
         uses: actions/setup-python@v6
@@ -1314,7 +1314,7 @@ jobs:
         shell: msys2 {0}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
 
diff --git a/.github/workflows/configure.yml b/.github/workflows/configure.yml
index e3d99dd872..49f043cf26 100644
--- a/.github/workflows/configure.yml
+++ b/.github/workflows/configure.yml
@@ -48,7 +48,7 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python 3.11
       uses: actions/setup-python@v6
diff --git a/.github/workflows/docs-link.yml b/.github/workflows/docs-link.yml
index ea25410cb9..a5c051ca02 100644
--- a/.github/workflows/docs-link.yml
+++ b/.github/workflows/docs-link.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Check for docs changes
         id: docs_changes
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 6bf77324a9..04b451c6bd 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -25,7 +25,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
     - uses: actions/setup-python@v6
       with:
         python-version: "3.x"
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     container: silkeh/clang:20
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Install requirements
       run: apt-get update && apt-get install -y git python3-dev python3-pytest ninja-build
diff --git a/.github/workflows/nightlies.yml b/.github/workflows/nightlies.yml
index 98211ca552..2fc7e6b582 100644
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'pybind'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -53,7 +53,7 @@ jobs:
         run: ls -lha dist/*.whl
 
       - name: Upload wheel to Anaconda Cloud as nightly
-        uses: scientific-python/upload-nightly-action@5748273c71e2d8d3a61f3a11a16421c8954f9ecf # 0.6.3
+        uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # 0.6.4
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index 981884a955..8f8ec2106f 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup 🐍 3.8
       uses: actions/setup-python@v6
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup 🐍 3.8
       uses: actions/setup-python@v6
diff --git a/.github/workflows/reusable-standard.yml b/.github/workflows/reusable-standard.yml
index 6e22d0f38b..9f119a6643 100644
--- a/.github/workflows/reusable-standard.yml
+++ b/.github/workflows/reusable-standard.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Python ${{ inputs.python-version }}
         uses: actions/setup-python@v6
diff --git a/.github/workflows/tests-cibw.yml b/.github/workflows/tests-cibw.yml
index f7bca76e77..813dfb3349 100644
--- a/.github/workflows/tests-cibw.yml
+++ b/.github/workflows/tests-cibw.yml
@@ -17,12 +17,12 @@ jobs:
     name: Pyodide wheel
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
         fetch-depth: 0
 
-    - uses: pypa/cibuildwheel@v3.4
+    - uses: pypa/cibuildwheel@v4.1
       env:
         PYODIDE_BUILD_EXPORTS: whole_archive
       with:
@@ -37,7 +37,7 @@ jobs:
       matrix:
         runs-on: [macos-14, macos-15-intel]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
         fetch-depth: 0
@@ -45,7 +45,7 @@ jobs:
     # We have to uninstall first because GH is now using a local tap to build cmake<4, iOS needs cmake>=4
     - run: brew uninstall cmake && brew install cmake
 
-    - uses: pypa/cibuildwheel@v3.4
+    - uses: pypa/cibuildwheel@v4.1
       env:
         CIBW_PLATFORM: ios
         CIBW_SKIP: cp314-*  # https://github.com/pypa/cibuildwheel/issues/2494
@@ -60,7 +60,7 @@ jobs:
       matrix:
         runs-on: [macos-latest, macos-15-intel, ubuntu-latest]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         submodules: true
         fetch-depth: 0
@@ -70,7 +70,7 @@ jobs:
       if: contains(matrix.runs-on, 'macos')
       run: echo "CIBW_TEST_COMMAND=" >> "$GITHUB_ENV"
 
-    - uses: pypa/cibuildwheel@v3.4
+    - uses: pypa/cibuildwheel@v4.1
       env:
         CIBW_PLATFORM: android
       with:
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 51354d68c3..9639d267c4 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -24,7 +24,7 @@ jobs:
     if: "contains(github.event.pull_request.labels.*.name, 'python dev')"
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Python 3.13
       uses: actions/setup-python@v6