diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6200c463f..fa5b0c179 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -137,7 +137,7 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PY_VERSION }}
-      - uses: dtolnay/rust-toolchain@1.96.0
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: ". -> target"
@@ -454,7 +454,7 @@ jobs:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-build-${{ hashFiles('pyproject.toml') }}
           restore-keys: ${{ runner.os }}-pip-build-
-      - uses: dtolnay/rust-toolchain@1.96.0
+      - uses: dtolnay/rust-toolchain@1.100.0
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: ". -> target"
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 7497624a7..c6cd3af4e 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -32,7 +32,7 @@ jobs:
       # `pip install -e .` invokes maturin (declared in pyproject.toml's
       # build-system) which calls cargo to compile the Rust extension.
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Cache cargo registry + build
         uses: Swatinem/rust-cache@v2
@@ -100,7 +100,7 @@ jobs:
           restore-keys: ${{ runner.os }}-pip-eval-
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Cache cargo registry + build
         uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0f756a724..5d93fc00e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,7 +25,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.96.0
+        uses: dtolnay/rust-toolchain@1.100.0
 
       - name: Cache cargo registry + build
         uses: Swatinem/rust-cache@v2
@@ -54,4 +54,4 @@ jobs:
           files: dist/headroom-sbom.cdx.json
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@v1.14.2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ce34b35c3..cefcc5bbe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -779,7 +779,7 @@ jobs:
 
       - name: Publish ${{ env.PYPI_PACKAGE }} to PyPI
         id: pypi-publish
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@v1.14.2
         with:
           # Idempotent re-runs: when a wheel filename for the computed
           # version is already on PyPI (e.g. a previous push to main