diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b0f1aee9da..fc673643be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -181,7 +181,7 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
@@ -242,7 +242,7 @@ jobs:
     timeout-minutes: 40
     container: quay.io/pypa/musllinux_1_2_x86_64:latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -279,7 +279,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python-version }} (deadsnakes)
       uses: deadsnakes/action@v3.2.0
@@ -366,7 +366,7 @@ jobs:
     container: "silkeh/clang:${{ matrix.clang }}${{ matrix.container_suffix }}"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add wget and python3
       run: apt-get update && apt-get install -y python3-dev python3-numpy python3-pytest libeigen3-dev
@@ -403,7 +403,7 @@ jobs:
     container: nvidia/cuda:12.2.0-devel-ubuntu22.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # tzdata will try to ask for the timezone, so set the DEBIAN_FRONTEND
     - name: Install 🐍 3
@@ -427,7 +427,7 @@ jobs:
 #    container: centos:8
 #
 #    steps:
-#    - uses: actions/checkout@v4
+#    - uses: actions/checkout@v5
 #
 #    - name: Add Python 3 and a few requirements
 #      run: yum update -y && yum install -y git python3-devel python3-numpy python3-pytest make environment-modules
@@ -473,7 +473,7 @@ jobs:
       # tzdata will try to ask for the timezone, so set the DEBIAN_FRONTEND
       DEBIAN_FRONTEND: 'noninteractive'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add NVHPC Repo
       run: |
@@ -534,7 +534,7 @@ jobs:
     container: "gcc:${{ matrix.gcc }}"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add Python 3
       run: apt-get update; apt-get install -y python3-dev python3-numpy python3-pytest python3-pip libeigen3-dev
@@ -597,7 +597,7 @@ jobs:
     name: "🐍 3 • ICC latest • x64"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Add apt repo
       run: |
@@ -710,7 +710,7 @@ jobs:
 
     steps:
     - name: Latest actions/checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Add Python 3.8
       if: matrix.container == 'almalinux:8'
@@ -811,7 +811,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - uses: actions/setup-python@v5
       with:
@@ -857,7 +857,7 @@ jobs:
     runs-on: windows-2022
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
       uses: actions/setup-python@v5
@@ -909,7 +909,7 @@ jobs:
     runs-on: windows-2022
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
       uses: actions/setup-python@v5
@@ -957,7 +957,7 @@ jobs:
     runs-on: windows-2022
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python ${{ matrix.python }}
       uses: actions/setup-python@v5
@@ -1043,7 +1043,7 @@ jobs:
           mingw-w64-${{matrix.env}}-catch
           ${{ matrix.extra_install }}
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Configure C++11
       # LTO leads to many undefined reference like
@@ -1133,7 +1133,7 @@ jobs:
         run: env
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Clang
         uses: egor-tensin/setup-clang@v1
diff --git a/.github/workflows/configure.yml b/.github/workflows/configure.yml
index 6a3b365de0..b4a904a2e6 100644
--- a/.github/workflows/configure.yml
+++ b/.github/workflows/configure.yml
@@ -48,7 +48,7 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python 3.11
       uses: actions/setup-python@v5
diff --git a/.github/workflows/docs-link.yml b/.github/workflows/docs-link.yml
index d1f1a17264..2f397aff97 100644
--- a/.github/workflows/docs-link.yml
+++ b/.github/workflows/docs-link.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Check for docs changes
         id: docs_changes
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 9258e27928..b1711daf79 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -25,7 +25,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - uses: actions/setup-python@v5
       with:
         python-version: "3.x"
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     container: silkeh/clang:20
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Install requirements
       run: apt-get update && apt-get install -y git python3-dev python3-pytest ninja-build
diff --git a/.github/workflows/nightlies.yml b/.github/workflows/nightlies.yml
index 788f0cdc31..3197f5abad 100644
--- a/.github/workflows/nightlies.yml
+++ b/.github/workflows/nightlies.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'pybind'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index 9b6a9dc824..e2ad0471e9 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup 🐍 3.8
       uses: actions/setup-python@v5
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup 🐍 3.8
       uses: actions/setup-python@v5
@@ -103,7 +103,7 @@ jobs:
     - uses: actions/download-artifact@v5
 
     - name: Generate artifact attestation for sdist and wheel
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v3
       with:
         subject-path: "*/pybind11*"
 
diff --git a/.github/workflows/reusable-standard.yml b/.github/workflows/reusable-standard.yml
index 5e258e7271..1723668e01 100644
--- a/.github/workflows/reusable-standard.yml
+++ b/.github/workflows/reusable-standard.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Setup Python ${{ inputs.python-version }}
         uses: actions/setup-python@v5
diff --git a/.github/workflows/tests-cibw.yml b/.github/workflows/tests-cibw.yml
index 71d07a764b..f232544bd9 100644
--- a/.github/workflows/tests-cibw.yml
+++ b/.github/workflows/tests-cibw.yml
@@ -17,7 +17,7 @@ jobs:
     name: Pyodide wheel
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         submodules: true
         fetch-depth: 0
@@ -37,7 +37,7 @@ jobs:
       matrix:
         runs-on: [macos-14, macos-13]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         submodules: true
         fetch-depth: 0
@@ -60,7 +60,7 @@ jobs:
       matrix:
         runs-on: [macos-latest, macos-13, ubuntu-latest]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         submodules: true
         fetch-depth: 0
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index 3892600381..4fb9a744ed 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -24,7 +24,7 @@ jobs:
     if: "contains(github.event.pull_request.labels.*.name, 'python dev')"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Setup Python 3.13
       uses: actions/setup-python@v5