diff --git a/.github/workflows/ci-citation.yml b/.github/workflows/ci-citation.yml
index 896ed89..6f70908 100644
--- a/.github/workflows/ci-citation.yml
+++ b/.github/workflows/ci-citation.yml
@@ -20,7 +20,7 @@ jobs:
     name: "validate"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci-locks.yml b/.github/workflows/ci-locks.yml
index 5447149..2187a2d 100644
--- a/.github/workflows/ci-locks.yml
+++ b/.github/workflows/ci-locks.yml
@@ -18,5 +18,5 @@ concurrency:
 
 jobs:
   refresh_lockfiles:
-    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2025.11.2
+    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2025.12.4
     secrets: inherit
diff --git a/.github/workflows/ci-manifest.yml b/.github/workflows/ci-manifest.yml
index 9e31870..c466cae 100644
--- a/.github/workflows/ci-manifest.yml
+++ b/.github/workflows/ci-manifest.yml
@@ -25,4 +25,4 @@ concurrency:
 jobs:
   manifest:
     name: "check-manifest"
-    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2025.11.2
+    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2025.12.4
diff --git a/.github/workflows/ci-template-check.yml b/.github/workflows/ci-template-check.yml
index ebd319a..5de3ae5 100644
--- a/.github/workflows/ci-template-check.yml
+++ b/.github/workflows/ci-template-check.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   prompt-share:
-    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2025.11.2
+    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2025.12.4
     secrets: inherit
     with:
       pr_number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index a783e40..8dc72e8 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -52,7 +52,7 @@ jobs:
             codecov: "codecov"
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/ci-wheels.yml b/.github/workflows/ci-wheels.yml
index 24e8778..553a672 100644
--- a/.github/workflows/ci-wheels.yml
+++ b/.github/workflows/ci-wheels.yml
@@ -43,7 +43,7 @@ jobs:
             arch: "AMD64"
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
 
@@ -59,7 +59,7 @@ jobs:
         CIBW_TEST_COMMAND: >
           python -m pytest --pyargs stratify
 
-    - uses: actions/upload-artifact@v5
+    - uses: actions/upload-artifact@v6
       with:
         name: pypi-${{ matrix.os }}-${{ matrix.arch }}-artifact
         path: ${{ github.workspace }}/wheelhouse/*.whl
@@ -69,7 +69,7 @@ jobs:
     name: "Build sdist"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
 
@@ -78,7 +78,7 @@ jobs:
       run: |
         pipx run build --sdist
 
-    - uses: actions/upload-artifact@v5
+    - uses: actions/upload-artifact@v6
       with:
         name: pypi-sdist
         path: ${{ github.workspace }}/dist/*.tar.gz
@@ -89,7 +89,7 @@ jobs:
     name: "Show artifacts"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v7
       with:
         merge-multiple: true
         path: ${{ github.workspace }}/dist
@@ -106,7 +106,7 @@ jobs:
     # upload to Test PyPI for every commit on main branch
     if: github.event_name == 'push' && github.event.ref == 'refs/heads/main'
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v7
       with:
         merge-multiple: true
         path: ${{ github.workspace }}/dist
@@ -127,7 +127,7 @@ jobs:
     # upload to PyPI for every tag starting with 'v'
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
     steps:
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@v7
       with:
         merge-multiple: true
         path: ${{ github.workspace }}/dist