diff --git a/.github/workflows/changeset-release.yml b/.github/workflows/changeset-release.yml
index ae7eb019..89d04e84 100644
--- a/.github/workflows/changeset-release.yml
+++ b/.github/workflows/changeset-release.yml
@@ -52,7 +52,7 @@ jobs:
     steps:
       - name: Mint app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3fe6c48b..55b6cb06 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
       # `directory: ./coverage` picks up the per-package lcov files
       # that bun test --coverage writes into each workspace.
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         if: ${{ !cancelled() }}
         with:
           flags: bun
@@ -69,7 +69,7 @@ jobs:
       # Codecov upload (#471) — same as the bun job but for the
       # Python SDK's coverage.xml.
       - name: Upload Python coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         if: ${{ !cancelled() }}
         with:
           flags: python