diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index b3742b7..6cf8ed0 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -55,11 +55,11 @@ jobs:
           git config --global user.name 'Conda Bot'
           git config --global user.email '18747875+conda-bot@users.noreply.github.com'
 
-      - uses: conda/actions/combine-durations@7873f9d7c90877290866eb893b8f6eff2e88429a # v25.1.2
+      - uses: conda/actions/combine-durations@c1c8ebf3059ee1645f9395771671262a7ea8da63 # v25.3.0
         id: durations
         continue-on-error: true
 
-      - uses: conda/actions/template-files@7873f9d7c90877290866eb893b8f6eff2e88429a # v25.1.2
+      - uses: conda/actions/template-files@c1c8ebf3059ee1645f9395771671262a7ea8da63 # v25.3.0
         id: templates
         continue-on-error: true
 
@@ -80,7 +80,7 @@ jobs:
       - if: github.event.comment.body != '@conda-bot render'
         id: create
         # no-op if no commits were made
-        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           push-to-fork: ${{ env.FORK }}
           token: ${{ secrets.SYNC_TOKEN }}