diff --git a/.github/workflows/benchmarks_report.yml b/.github/workflows/benchmarks_report.yml
index 8d7dfb6b0b..8caf063e74 100644
--- a/.github/workflows/benchmarks_report.yml
+++ b/.github/workflows/benchmarks_report.yml
@@ -54,7 +54,7 @@ jobs:
           echo "reports_exist=$reports_exist" >> "$GITHUB_OUTPUT"
 
       - name: Store artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark_reports
           path: benchmark_reports
@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Download artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: benchmark_reports
           path: .github/workflows/benchmark_reports
diff --git a/.github/workflows/benchmarks_run.yml b/.github/workflows/benchmarks_run.yml
index 9b30d6a848..bfbf5a81f0 100644
--- a/.github/workflows/benchmarks_run.yml
+++ b/.github/workflows/benchmarks_run.yml
@@ -157,7 +157,7 @@ jobs:
       - name: Upload any benchmark reports
         # Uploading enables more downstream processing e.g. posting a PR comment.
         if: success() || steps.overnight.outcome == 'failure'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark_reports
           path: .github/workflows/benchmark_reports
@@ -165,7 +165,7 @@ jobs:
       - name: Archive asv results
         # Store the raw ASV database(s) to help manual investigations.
         if: ${{ always() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: asv-raw-results
           path: benchmarks/.asv/results
diff --git a/.github/workflows/ci-linkchecks.yml b/.github/workflows/ci-linkchecks.yml
index 83ef091a19..6ffdd3df93 100644
--- a/.github/workflows/ci-linkchecks.yml
+++ b/.github/workflows/ci-linkchecks.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411
         with:
           token: ${{secrets.GITHUB_TOKEN}}
           fail: false
diff --git a/.github/workflows/ci-manifest.yml b/.github/workflows/ci-manifest.yml
index 47d8ee8c7a..46f8fda4c8 100644
--- a/.github/workflows/ci-manifest.yml
+++ b/.github/workflows/ci-manifest.yml
@@ -23,4 +23,4 @@ concurrency:
 jobs:
   manifest:
     name: "check-manifest"
-    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2025.12.4
+    uses: scitools/workflows/.github/workflows/ci-manifest.yml@2026.03.2
diff --git a/.github/workflows/ci-template-check.yml b/.github/workflows/ci-template-check.yml
index 5de3ae5fd0..3d0bb0d12d 100644
--- a/.github/workflows/ci-template-check.yml
+++ b/.github/workflows/ci-template-check.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   prompt-share:
-    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2025.12.4
+    uses: scitools/workflows/.github/workflows/ci-template-check.yml@2026.03.2
     secrets: inherit
     with:
       pr_number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/ci-wheels.yml b/.github/workflows/ci-wheels.yml
index d2bf28aa8e..1dbb83f32a 100644
--- a/.github/workflows/ci-wheels.yml
+++ b/.github/workflows/ci-wheels.yml
@@ -37,7 +37,7 @@ jobs:
       run: |
         pipx run build
 
-    - uses: actions/upload-artifact@v6
+    - uses: actions/upload-artifact@v7
       with:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist/*
@@ -61,7 +61,7 @@ jobs:
       with:
         fetch-depth: 0
 
-    - uses: actions/download-artifact@v7
+    - uses: actions/download-artifact@v8
       with:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
@@ -116,7 +116,7 @@ jobs:
     name: "show artifacts"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v7
+    - uses: actions/download-artifact@v8
       with:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
@@ -137,7 +137,7 @@ jobs:
     # and check for the SciTools repo
     if: github.event_name == 'push' && github.event.ref == 'refs/heads/main' && github.repository_owner == 'SciTools'
     steps:
-    - uses: actions/download-artifact@v7
+    - uses: actions/download-artifact@v8
       with:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
@@ -159,7 +159,7 @@ jobs:
     # upload to PyPI for every tag starting with 'v'
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v') && github.repository_owner == 'SciTools'
     steps:
-    - uses: actions/download-artifact@v7
+    - uses: actions/download-artifact@v8
       with:
         name: pypi-artifacts
         path: ${{ github.workspace }}/dist
diff --git a/.github/workflows/refresh-lockfiles.yml b/.github/workflows/refresh-lockfiles.yml
index be483ff659..69eb9a52c3 100644
--- a/.github/workflows/refresh-lockfiles.yml
+++ b/.github/workflows/refresh-lockfiles.yml
@@ -14,5 +14,5 @@ on:
 
 jobs:
   refresh_lockfiles:
-    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2025.12.4
+    uses: scitools/workflows/.github/workflows/refresh-lockfiles.yml@2026.03.2
     secrets: inherit