diff --git a/.github/workflows/tidy3d-python-client-deploy.yml b/.github/workflows/tidy3d-python-client-deploy.yml
index 6255109b2e..85c5764bb0 100644
--- a/.github/workflows/tidy3d-python-client-deploy.yml
+++ b/.github/workflows/tidy3d-python-client-deploy.yml
@@ -113,7 +113,7 @@ jobs:
           echo "Package built successfully"
       
       - name: upload-artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: dist-${{ needs.validate-inputs.outputs.release_tag }}
           path: dist/
@@ -126,7 +126,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: download-artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist-${{ needs.validate-inputs.outputs.release_tag }}
           path: dist/
@@ -165,7 +165,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: download-artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist-${{ needs.validate-inputs.outputs.release_tag }}
           path: dist/
diff --git a/.github/workflows/tidy3d-python-client-release.yml b/.github/workflows/tidy3d-python-client-release.yml
index aa2982dc29..f201a9cc8c 100644
--- a/.github/workflows/tidy3d-python-client-release.yml
+++ b/.github/workflows/tidy3d-python-client-release.yml
@@ -461,7 +461,7 @@ jobs:
           persist-credentials: false
       
       - name: create-github-release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe  # v2.6.1
         with:
           tag_name: ${{ env.RELEASE_TAG }}
           generate_release_notes: true
diff --git a/.github/workflows/tidy3d-python-client-tests.yml b/.github/workflows/tidy3d-python-client-tests.yml
index a0d77611e3..e71e8783c7 100644
--- a/.github/workflows/tidy3d-python-client-tests.yml
+++ b/.github/workflows/tidy3d-python-client-tests.yml
@@ -342,7 +342,7 @@ jobs:
     - name: restore-testmon-cache
       id: testmon-cache-restore
       if: needs.determine-test-scope.outputs.test_selection == 'testmon' || github.event_name == 'merge_group'
-      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: .testmondata
         key: testmon-local-${{ steps.testmon-cache-key.outputs.cache_layout }}-${{ runner.os }}-py${{ matrix.python-version }}-${{ steps.testmon-cache-key.outputs.default_branch }}-${{ steps.testmon-cache-key.outputs.dep_hash }}-${{ steps.testmon-cache-key.outputs.cache_sha }}
@@ -455,7 +455,7 @@ jobs:
 
     - name: upload-testmon-cache-candidate
       if: success() && github.event_name == 'merge_group' && hashFiles('.testmondata') != ''
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: testmon-cache-candidate-local-${{ runner.os }}-py${{ matrix.python-version }}-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/testmon-cache-candidate-local-py${{ matrix.python-version }}
@@ -464,7 +464,7 @@ jobs:
 
     - name: save-testmon-cache
       if: success() && github.event_name == 'merge_group' && steps.testmon-cache-restore.outputs.cache-hit != 'true' && hashFiles('.testmondata') != ''
-      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: .testmondata
         key: testmon-local-${{ steps.testmon-cache-key.outputs.cache_layout }}-${{ runner.os }}-py${{ matrix.python-version }}-${{ steps.testmon-cache-key.outputs.default_branch }}-${{ steps.testmon-cache-key.outputs.dep_hash }}-${{ steps.testmon-cache-key.outputs.cache_sha }}
@@ -609,7 +609,7 @@ jobs:
     - name: restore-testmon-cache
       id: testmon-cache-restore
       if: needs.determine-test-scope.outputs.test_selection == 'testmon' || github.event_name == 'merge_group'
-      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: .testmondata
         key: testmon-remote-${{ steps.testmon-cache-key.outputs.cache_layout }}-${{ matrix.platform }}-py${{ matrix.python-version }}-${{ steps.testmon-cache-key.outputs.default_branch }}-${{ steps.testmon-cache-key.outputs.dep_hash }}-${{ steps.testmon-cache-key.outputs.cache_sha }}
@@ -725,7 +725,7 @@ jobs:
 
     - name: upload-testmon-cache-candidate
       if: success() && github.event_name == 'merge_group' && hashFiles('.testmondata') != ''
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: testmon-cache-candidate-remote-${{ matrix.platform }}-py${{ matrix.python-version }}-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/testmon-cache-candidate-remote-${{ matrix.platform }}-py${{ matrix.python-version }}
@@ -734,7 +734,7 @@ jobs:
 
     - name: save-testmon-cache
       if: success() && github.event_name == 'merge_group' && steps.testmon-cache-restore.outputs.cache-hit != 'true' && hashFiles('.testmondata') != ''
-      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: .testmondata
         key: testmon-remote-${{ steps.testmon-cache-key.outputs.cache_layout }}-${{ matrix.platform }}-py${{ matrix.python-version }}-${{ steps.testmon-cache-key.outputs.default_branch }}-${{ steps.testmon-cache-key.outputs.dep_hash }}-${{ steps.testmon-cache-key.outputs.cache_sha }}
@@ -742,7 +742,7 @@ jobs:
     - name: create-badge
       if: ${{ github.ref == 'refs/heads/develop' }}
       # https://gist.githubusercontent.com/nedbat/8c6980f77988a327348f9b02bbaf67f5
-      uses: schneegans/dynamic-badges-action@e9a478b16159b4d31420099ba146cdc50f134483  # v1.7.0
+      uses: schneegans/dynamic-badges-action@0e50b8bad39e7e1afd3e4e9c2b7dd145fad07501  # v1.8.0
       with:
         auth: ${{ secrets.GH_TIDY3D_COVERAGE_GIST }}
         gistID: 4702549574741e87deaadba436218ebd
diff --git a/.github/workflows/tidy3d-testmon-cache-promote.yml b/.github/workflows/tidy3d-testmon-cache-promote.yml
index 630dd83686..2a938549b6 100644
--- a/.github/workflows/tidy3d-testmon-cache-promote.yml
+++ b/.github/workflows/tidy3d-testmon-cache-promote.yml
@@ -87,7 +87,7 @@ jobs:
           echo "source_run_id=$source_run_id" >> "$GITHUB_OUTPUT"
 
       - name: download-cache-candidate-artifacts-source-run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           github-token: ${{ github.token }}
           repository: ${{ github.repository }}
@@ -191,7 +191,7 @@ jobs:
         candidate: ${{ fromJson(needs.discover-cache-candidates.outputs.candidates || '[]') }}
     steps:
       - name: download-cache-candidate
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           github-token: ${{ github.token }}
           repository: ${{ github.repository }}
@@ -231,7 +231,7 @@ jobs:
 
       - name: lookup-existing-cache
         id: cache-lookup
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .testmondata
           key: ${{ matrix.candidate.cache_key }}
@@ -239,7 +239,7 @@ jobs:
 
       - name: save-promoted-testmon-cache
         if: steps.cache-lookup.outputs.cache-hit != 'true'
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .testmondata
           key: ${{ matrix.candidate.cache_key }}
@@ -252,7 +252,7 @@ jobs:
 
       - name: verify-promoted-cache-lookup
         id: verify-cache-lookup
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .testmondata
           key: ${{ matrix.candidate.cache_key }}