diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7417b1c8d1..c749202171 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -84,8 +84,14 @@ jobs:
         # is not empty
         [ "$(ls -A docs/_build/html/lite)" ]
 
+    - name: Fix permissions if needed
+      run: |
+        chmod -c -R +rX "docs/_build/html/" | while read line; do
+          echo "::warning title=Invalid file permissions automatically fixed::$line"
+        done
+
     - name: Upload artifact
-      uses: actions/upload-pages-artifact@v1
+      uses: actions/upload-pages-artifact@v2
       with:
         path: 'docs/_build/html'
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e2bee7b88b..e84cf76ff1 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,6 +18,6 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Lint Dockerfile
-      uses: hadolint/hadolint-action@v2.1.0
+      uses: hadolint/hadolint-action@v3.1.0
       with:
         dockerfile: docker/Dockerfile
diff --git a/.github/workflows/lower-bound-requirements.yml b/.github/workflows/lower-bound-requirements.yml
index eec586eace..37b3c741a2 100644
--- a/.github/workflows/lower-bound-requirements.yml
+++ b/.github/workflows/lower-bound-requirements.yml
@@ -39,4 +39,4 @@ jobs:
         # free. Though still show warnings by setting warning control to 'default'.
         export PYTHONWARNINGS='default'
         # Run on tests/ to skip doctests of src given examples are for latest APIs
-        pytest --override-ini filterwarnings= --ignore tests/benchmarks/ --ignore tests/contrib --ignore tests/test_notebooks.py tests/
+        pytest --override-ini filterwarnings= --ignore tests/contrib --ignore tests/benchmarks --ignore tests/test_notebooks.py tests/
diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml
index d39034a63c..51a009e2ce 100644
--- a/.github/workflows/publish-package.yml
+++ b/.github/workflows/publish-package.yml
@@ -123,13 +123,13 @@ jobs:
       if: >-
         (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pyhf')
         || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pyhf')
-      uses: pypa/gh-action-pypi-publish@v1.8.6
+      uses: pypa/gh-action-pypi-publish@v1.8.10
       with:
         repository-url: https://test.pypi.org/legacy/
         print-hash: true
 
     - name: Publish distribution 📦 to PyPI
       if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pyhf'
-      uses: pypa/gh-action-pypi-publish@v1.8.6
+      uses: pypa/gh-action-pypi-publish@v1.8.10
       with:
         print-hash: true