diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 776ffdaf..d4ea2f09 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 93091615..68f52d89 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,10 +10,10 @@ jobs:
     permissions:
       contents: write  # to push to the gh-pages branch
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0  # needed to get the gh-pages branch
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.10"
       - name: Install dependencies and Studio
diff --git a/.github/workflows/matrix-tests.yml b/.github/workflows/matrix-tests.yml
index a0747040..7c10ecca 100644
--- a/.github/workflows/matrix-tests.yml
+++ b/.github/workflows/matrix-tests.yml
@@ -16,7 +16,7 @@ jobs:
         python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: FedericoCarboni/setup-ffmpeg@v2
         if : runner.os != 'macOS'
       - run: brew install ffmpeg
diff --git a/.github/workflows/pythonpublish.yml b/.github/workflows/pythonpublish.yml
index 4834bcd9..5409e23c 100644
--- a/.github/workflows/pythonpublish.yml
+++ b/.github/workflows/pythonpublish.yml
@@ -25,10 +25,10 @@ jobs:
       contents: write  # allows creating a GitHub Release
       id-token: write  # allows signing the dists with Sigstore
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.x"
 
@@ -86,10 +86,10 @@ jobs:
     permissions:
       contents: write  # to push to the gh-pages branch
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0  # needed to get the gh-pages branch
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.10"
       - name: Install dependencies and Studio
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d79bd6c9..db1149d3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,12 +13,12 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: FedericoCarboni/setup-ffmpeg@v2
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.9"
           cache: "pip"
@@ -51,9 +51,8 @@ jobs:
         #  - setuptools is MIT, but not always auto-detected.
         run: licensecheck --requirements-path pyproject.toml --zero --ignore-packages pympi-ling text-unidecode setuptools
 
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
-          directory: ./tests
           token: ${{ secrets.CODECOV_TOKEN }}  # optional but apparently makes upload more reliable
           fail_ci_if_error: false # too many upload errors to keep "true"
 
@@ -83,7 +82,7 @@ jobs:
       - name: Report help speed in a PR comment
         if: github.event_name == 'pull_request'
         continue-on-error: true
-        uses: mshick/add-pr-comment@v2
+        uses: mshick/add-pr-comment@7c1a3a3e5a072270dc21c0639df39ca11e860b2b # v3.5.0
         with:
           preformatted: true
           message-path: import-message.txt
@@ -92,12 +91,12 @@ jobs:
     runs-on: windows-latest
     if: ${{ !contains(github.event.head_commit.message, '#no-ci') }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: FedericoCarboni/setup-ffmpeg@v2
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.9"
           cache: "pip"
@@ -126,7 +125,7 @@ jobs:
   test-heroku-env:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Read the Heroku run time env and cmd
         run: |
@@ -134,7 +133,7 @@ jobs:
           echo "RUNTIME_CMD=$(cat Procfile | grep web: | sed 's/web: *//')" >> $GITHUB_ENV
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "${{ env.PYTHON_VERSION }}"
           cache: "pip"