diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9e401a1
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+        interval: "weekly"
diff --git a/.github/workflows/backend-ci.yml b/.github/workflows/backend-ci.yml
index 5521448..9b36c2a 100644
--- a/.github/workflows/backend-ci.yml
+++ b/.github/workflows/backend-ci.yml
@@ -22,14 +22,19 @@ jobs:
         python-version: ["3.12"]
         toxenv: [quality, docs, pii_check, django52, django60]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: setup python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # Every matrix job populates the uv cache with a different set of tox
+          # dependencies, so give each one its own cache key. Sharing a single
+          # key makes the jobs race to save it, and all but the winner warn.
+          cache-suffix: ${{ matrix.toxenv }}
 
       - name: Install CI dependencies
         run: uv sync --group ci
@@ -41,7 +46,7 @@ jobs:
 
       - name: Run coverage
         if: matrix.python-version == '3.12' && matrix.toxenv == 'django52'
-        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: unittests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ee9ff4..f03a32f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,10 +50,23 @@ jobs:
           # are attached before the release is published. See that step for why.
           vcs_release: "false"
 
+      # Built before the release is created so that its distributions can be
+      # attached as release assets too. See the release step for why that
+      # ordering matters.
+      - name: Build | Tutor Plugin
+        # The tutor plugin does not use python-semantic-release directly.
+        # Instead it shares the version determined by the backend's semantic
+        # release above, passed in via SETUPTOOLS_SCM_PRETEND_VERSION so that
+        # setuptools-scm picks it up at build time.
+        if: steps.release.outputs.released == 'true'
+        run: pip install build && SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.release.outputs.version }} python -m build
+        working-directory: './tutor-contrib-sample'
+
       # This repo has immutable releases enabled, which freezes a release's
       # assets the moment it is published, so assets cannot be attached
-      # afterwards. `gh release create` handles this by creating the release as
-      # a draft, uploading the assets, and only then publishing it:
+      # afterwards. Everything we want on the release has to be built by now
+      # and passed to this one command, which creates the release as a draft,
+      # uploads the assets, and only then publishes it:
       # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
       - name: Publish | Create GitHub Release with Assets
         if: steps.release.outputs.released == 'true'
@@ -65,12 +78,14 @@ jobs:
         run: |
           # Output the release notes to a file
           printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
-          # Create a draft release
+          # Creates the release as a draft, uploads the assets, and then
+          # publishes it -- all within this one command.
           gh release create "$TAG" \
             --verify-tag \
             --title "$TAG" \
             --notes-file "$RUNNER_TEMP/release_notes.md" \
-            backend-plugin-sample/dist/*
+            backend-plugin-sample/dist/* \
+            tutor-contrib-sample/dist/*
 
       - name: Upload | Backend Distribution Artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -80,15 +95,6 @@ jobs:
           path: backend-plugin-sample/dist
           if-no-files-found: error
 
-      - name: Build | Tutor Plugin
-        # The tutor plugin does not use python-semantic-release directly.
-        # Instead it shares the version determined by the backend's semantic
-        # release above, passed in via SETUPTOOLS_SCM_PRETEND_VERSION so that
-        # setuptools-scm picks it up at build time.
-        if: steps.release.outputs.released == 'true'
-        run: pip install build && SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.release.outputs.version }} python -m build
-        working-directory: './tutor-contrib-sample'
-
       - name: Upload | Tutor Plugin Distribution Artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: steps.release.outputs.released == 'true'
diff --git a/backend-plugin-sample/pyproject.toml b/backend-plugin-sample/pyproject.toml
index d139be7..2934fc1 100644
--- a/backend-plugin-sample/pyproject.toml
+++ b/backend-plugin-sample/pyproject.toml
@@ -14,7 +14,8 @@ authors = [
 classifiers = [
     'Development Status :: 3 - Alpha',
     'Framework :: Django',
-    'Framework :: Django :: 4.2',
+    'Framework :: Django :: 5.2',
+    'Framework :: Django :: 6.0',
     'Intended Audience :: Developers',
     'Natural Language :: English',
     'Programming Language :: Python :: 3',