diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index d55fcef..2949a9d 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -101,7 +101,7 @@ jobs:
       # into the "fixed" binary, silently, with a green build.
       - name: Restore dependency cache
         id: cache-deps
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ${{ env.SB_BUILD_DIR }}/deps
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index e3e3127..200a875 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -62,7 +62,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pypa/cibuildwheel@v4.1.1
+      - uses: pypa/cibuildwheel@v4.2.0
         env:
           CIBW_ARCHS: ${{ matrix.arch }}
           # musl images have no prebuilt plastimatch archive to wrap.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 497868c..2bd7376 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,7 +54,7 @@ jobs:
       # test environment (test-command in pyproject.toml). That covers the DICOM round-trip,
       # so a broken archive pin or a binary that cannot read DICOM fails here rather than
       # after publishing.
-      - uses: pypa/cibuildwheel@v4.1.1
+      - uses: pypa/cibuildwheel@v4.2.0
         env:
           CIBW_ARCHS: ${{ matrix.arch }}
           CIBW_SKIP: "*musllinux*"