diff --git a/.github/workflows/bencher-plots.yml b/.github/workflows/bencher-plots.yml
index 2db968c6..1ea2e5db 100644
--- a/.github/workflows/bencher-plots.yml
+++ b/.github/workflows/bencher-plots.yml
@@ -46,7 +46,7 @@ jobs:
           auto-config: false
           build: false
           use-github-cache: false
-      - uses: bencherdev/bencher@v0.6.11
+      - uses: bencherdev/bencher@v0.6.12
       # Plot create/delete needs those permissions on the ix project: a
       # user-scoped `bencher_user_*` key (the report-upload token the bench
       # workflows use may be run-scoped and unable to manage plots).
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index a5089f05..acb8ec96 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -14,7 +14,7 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Mint a token from the GitHub App so the opened PR triggers CI; pushes
       # made with GITHUB_TOKEN do not. Same App as the org repo-sync workflows.