diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4fab0a1c..c771a92b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -359,7 +359,7 @@ jobs:
           labels: ${{ steps.metadata.outputs.labels }}
       - name: Generate signed attestations
         if: startsWith(github.ref, 'refs/tags/jq-')
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.build-push.outputs.digest }}
@@ -395,7 +395,7 @@ jobs:
           gh release create "$TAG_NAME" --draft --title "jq ${TAG_NAME#jq-}" --generate-notes
           gh release upload "$TAG_NAME" --clobber jq-* sha256sum.txt
       - name: Generate signed attestations
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-path: jq-*
       - name: Import GPG key
diff --git a/.github/workflows/manpage.yml b/.github/workflows/manpage.yml
index 647f37b2..fcdb18a2 100644
--- a/.github/workflows/manpage.yml
+++ b/.github/workflows/manpage.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
           cache: pipenv
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index d96947ce..b4132339 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
           cache: pipenv