diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fb2b8f4..1f9b381 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
       UOS_HELPDESK_MCP_TOKEN: ci-dummy
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.3.2
+      - uses: astral-sh/setup-uv@v9.0.0
         with:
           enable-cache: true
       - run: uv venv --python 3.12
@@ -74,7 +74,7 @@ jobs:
       # PR builds should not publish images). PRs still build via the matrix below.
       - name: Log in to GHCR
         if: github.event_name == 'push'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}