diff --git a/.github/workflows/emscripten.yaml b/.github/workflows/emscripten.yaml
index 14b2b9dc7d..5eac089e5c 100644
--- a/.github/workflows/emscripten.yaml
+++ b/.github/workflows/emscripten.yaml
@@ -22,7 +22,7 @@ jobs:
         submodules: true
         fetch-depth: 0
 
-    - uses: pypa/cibuildwheel@v2.20
+    - uses: pypa/cibuildwheel@v2.22
       env:
         PYODIDE_BUILD_EXPORTS: whole_archive
       with:
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index 3713537379..6d17993509 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -103,7 +103,7 @@ jobs:
     - uses: actions/download-artifact@v4
 
     - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+      uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
       with:
         subject-path: "*/pybind11*"