diff --git a/.github/workflows/diff.yml b/.github/workflows/diff.yml
index d9fd20c59..3a81ba2e1 100644
--- a/.github/workflows/diff.yml
+++ b/.github/workflows/diff.yml
@@ -13,7 +13,9 @@ jobs:
         with:
           go-version: 1.18
       - name: Install benchstat
-        run: go install golang.org/x/perf/cmd/benchstat@latest
+        # NOTE: benchstat@latest requires go 1.23 since 2025-02-14 - this is the last go 1.18 ref
+        # https://cs.opensource.google/go/x/perf/+/c95ad7d5b636f67d322a7e4832e83103d0fdd292
+        run: go install golang.org/x/perf/cmd/benchstat@884df5810d2850d775c2cb4885a7ea339128a17d
 
       - uses: actions/checkout@v3
       - name: Benchmark new code
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index b883b8393..34e77d6be 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -21,14 +21,14 @@ jobs:
           fuzz-seconds: 600
           output-sarif: true
       - name: Upload Crash
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         if: failure() && steps.build.outcome == 'success'
         with:
           name: artifacts
           path: ./out/artifacts
       - name: Upload Sarif
         if: always() && steps.build.outcome == 'success'
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           # Path to SARIF file relative to the root of the repository
           sarif_file: cifuzz-sarif/results.sarif