diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 200a875..23d5d39 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -62,7 +62,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pypa/cibuildwheel@v4.2.0
+      - uses: pypa/cibuildwheel@v4.2.1
         env:
           CIBW_ARCHS: ${{ matrix.arch }}
           # musl images have no prebuilt plastimatch archive to wrap.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2bd7376..629f884 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,7 +54,7 @@ jobs:
       # test environment (test-command in pyproject.toml). That covers the DICOM round-trip,
       # so a broken archive pin or a binary that cannot read DICOM fails here rather than
       # after publishing.
-      - uses: pypa/cibuildwheel@v4.2.0
+      - uses: pypa/cibuildwheel@v4.2.1
         env:
           CIBW_ARCHS: ${{ matrix.arch }}
           CIBW_SKIP: "*musllinux*"