diff --git a/.github/workflows/AWSMegatests.yml b/.github/workflows/AWSMegatests.yml
index 1166a640..ec9512a7 100644
--- a/.github/workflows/AWSMegatests.yml
+++ b/.github/workflows/AWSMegatests.yml
@@ -37,19 +37,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Install Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: 3.13.x
+          python-version: 3.14.x
 
       - run: pip install -r requirements.txt
         working-directory: ${{ env.PULUMI_WORKING_DIRECTORY }}
 
       - name: PR previews
         if: ${{ github.event_name == 'pull_request' }}
-        uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6
+        uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 # v6
         with:
           command: preview
           stack-name: ${{ env.PULUMI_STACK_NAME }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Apply infrastructure update
         if: ${{ github.event_name == 'push' }}
-        uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6
+        uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 # v6
         with:
           command: up
           stack-name: ${{ env.PULUMI_STACK_NAME }}
diff --git a/.github/workflows/backups.yml b/.github/workflows/backups.yml
index 0fa324e8..31da0ddc 100644
--- a/.github/workflows/backups.yml
+++ b/.github/workflows/backups.yml
@@ -51,7 +51,7 @@ jobs:
           echo "TARBALL_FILENAME=$TARBALL_FILENAME" >> $GITHUB_OUTPUT
 
       - name: setup aws cli
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ secrets.AWS_BACKUP_ROLE }}
           aws-region: eu-west-1
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index adce8e0e..9e9ed798 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,8 +14,8 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
diff --git a/.github/workflows/sync-test-datasets.yml b/.github/workflows/sync-test-datasets.yml
index 59efdbc1..6b8f0e8f 100644
--- a/.github/workflows/sync-test-datasets.yml
+++ b/.github/workflows/sync-test-datasets.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Get pipeline names and filter branches
         id: get-branches
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             // Fetch pipeline names from nf-core website
@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -101,7 +101,7 @@ jobs:
 
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}