diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index a8d37012..26c4d894 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: Build and test PyWavelets
-        uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
+        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074 # v4.2.0
         env:
           CIBW_PLATFORM: pyodide
           CIBW_TEST_REQUIRES: pytest matplotlib
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 059bb41e..dfa42403 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           # Pin the tool, not just the action: the action's `version` input defaults to
           # `latest`, so without this a new zizmor release adding an audit would turn CI