diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0c0489a6..4702ec30 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -312,7 +312,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation for sdist and wheel
-        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
+        uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
         with:
           subject-path: "dist/cmake-*"
 
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index a70d37ff..2b262835 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -26,7 +26,7 @@ jobs:
           dependency_nice: "OpenSSL"
     steps:
     - uses: actions/checkout@v4
-    - uses: wntrblm/nox@2025.02.09
+    - uses: wntrblm/nox@2025.05.01
     - name: "Run update: bump ${{ matrix.dependency_nice }}"
       id: bump
       run: |