diff --git a/.github/workflows/_envelope.yml b/.github/workflows/_envelope.yml
index 457b808..81b17f5 100644
--- a/.github/workflows/_envelope.yml
+++ b/.github/workflows/_envelope.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Download every evidence partial that was produced
         # No `name:` -> downloads all partials from this run into partials/<artifact-name>/. Tolerant
diff --git a/.github/workflows/_heavy.yml b/.github/workflows/_heavy.yml
index 530ce08..5f1ddbb 100644
--- a/.github/workflows/_heavy.yml
+++ b/.github/workflows/_heavy.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Start Postgres + NATS (compose waits for both healthchecks)
         run: docker compose -f services/content/docker-compose.yaml up -d --wait
@@ -83,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Stryker on the critical modules
         run: pnpm stryker:critical
@@ -105,9 +105,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
-      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
         with:
           distribution: temurin
           java-version: '17'
@@ -144,7 +144,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - uses: ./.github/actions/cluster-up
         with:
diff --git a/.github/workflows/_integration.yml b/.github/workflows/_integration.yml
index 382a535..6097547 100644
--- a/.github/workflows/_integration.yml
+++ b/.github/workflows/_integration.yml
@@ -32,9 +32,9 @@ jobs:
         options: >-
           --health-cmd "pg_isready -U qaroom" --health-interval 5s --health-timeout 5s --health-retries 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "0.8.15"
       - name: Aggregate the in-proc summary (the runners the claims' evidence resolves against)
@@ -61,7 +61,7 @@ jobs:
       matrix:
         provider: [content, identity, donations, flags, webhooks]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Pact provider verification (${{ matrix.provider }})
         run: pnpm pact:verify --provider ${{ matrix.provider }}
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Start Postgres + NATS
         run: docker compose -f services/content/docker-compose.yaml up -d --wait
@@ -114,7 +114,7 @@ jobs:
             db: postgres://qaroom:qaroom@localhost:5436/qaroom_webhooks
             port: 8087
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Start ${{ matrix.service }} Postgres
         run: docker compose -f ${{ matrix.compose }} up -d --wait
@@ -145,7 +145,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Install Chromium
         run: pnpm --filter @qaroom/web exec playwright install --with-deps chromium
@@ -169,9 +169,9 @@ jobs:
         options: >-
           --health-cmd "pg_isready -U qaroom" --health-interval 5s --health-timeout 5s --health-retries 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "0.8.15"
       - name: Lint (ruff)
@@ -204,7 +204,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
         with:
           version: v4.1.1
@@ -230,7 +230,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - uses: ./.github/actions/cluster-up
         with:
@@ -256,7 +256,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - uses: ./.github/actions/cluster-up
         with:
@@ -283,7 +283,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Install Chromium
         run: pnpm --filter @qaroom/web exec playwright install --with-deps chromium
@@ -318,7 +318,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Visual-regression gate (pinned container)
         run: |
           docker build -f services/web/Dockerfile.visual -t qaroom/visual .
@@ -330,7 +330,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Coverage floor gate
         run: pnpm coverage
diff --git a/.github/workflows/agent-controls.yml b/.github/workflows/agent-controls.yml
index 45b0924..17cacad 100644
--- a/.github/workflows/agent-controls.yml
+++ b/.github/workflows/agent-controls.yml
@@ -34,7 +34,7 @@ jobs:
   flag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Flag test-file (oracle) edits — read-only-tests posture
diff --git a/.github/workflows/auto-merge-router.yml b/.github/workflows/auto-merge-router.yml
index 2cfabab..1c4ed2e 100644
--- a/.github/workflows/auto-merge-router.yml
+++ b/.github/workflows/auto-merge-router.yml
@@ -31,7 +31,7 @@ jobs:
       # don't claim a scope the YAML doesn't enforce.
       AUTO_MERGE_ENABLED: 'false'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-workspace
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 465e91a..2cd0b38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # Lint the workflow YAML itself (expressions, needs/if/matrix graph, runner labels, and — via
       # the runner's preinstalled shellcheck — the `run:` shell blocks). Cheap, and now load-bearing:
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 4b090d7..ff43f1f 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -27,9 +27,9 @@ jobs:
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
-      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           version: "0.8.15"
       - name: Pre-flight cost guard (estimate vs MODERATOR_EVAL_BUDGET_TOKENS)
diff --git a/.github/workflows/frontend-perf.yml b/.github/workflows/frontend-perf.yml
index b9e6237..eec9345 100644
--- a/.github/workflows/frontend-perf.yml
+++ b/.github/workflows/frontend-perf.yml
@@ -39,7 +39,7 @@ jobs:
   lighthouse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Build the web app (tsc + vite build)
         run: pnpm --filter @qaroom/web build
@@ -59,7 +59,7 @@ jobs:
   bundle-budget:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Build the web app (tsc + vite build)
         run: pnpm --filter @qaroom/web build
@@ -72,7 +72,7 @@ jobs:
   k6-soak-stress:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/actions/setup-workspace
       - name: Start Postgres + NATS (compose waits for both healthchecks)
         run: docker compose -f services/content/docker-compose.yaml up -d --wait
diff --git a/.github/workflows/gate-guard.yml b/.github/workflows/gate-guard.yml
index 98d7572..1b625b1 100644
--- a/.github/workflows/gate-guard.yml
+++ b/.github/workflows/gate-guard.yml
@@ -30,7 +30,7 @@ jobs:
   flag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Flag gate-self-weakening
diff --git a/.github/workflows/invariant-guard.yml b/.github/workflows/invariant-guard.yml
index 76bca85..b1ab2eb 100644
--- a/.github/workflows/invariant-guard.yml
+++ b/.github/workflows/invariant-guard.yml
@@ -45,7 +45,7 @@ jobs:
   flag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Flag invariant-source changes
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index d9c503a..59e17ec 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -36,7 +36,7 @@ jobs:
       integration: ${{ steps.decide.outputs.integration }}
       heavy: ${{ steps.decide.outputs.heavy }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Decide which tiers to run
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 604fccf..d2d7620 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -33,7 +33,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
         with:
           enablement: true
diff --git a/.github/workflows/promotion-ledger-guard.yml b/.github/workflows/promotion-ledger-guard.yml
index 4f54bc0..9321910 100644
--- a/.github/workflows/promotion-ledger-guard.yml
+++ b/.github/workflows/promotion-ledger-guard.yml
@@ -33,7 +33,7 @@ jobs:
   flag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Measure the measure
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9175f9e..43fb254 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ jobs:
       matrix:
         service: [content, identity, gateway, donations, flags, webhooks, moderator-agent, web]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build ${{ matrix.service }} image (compile only — not pushed)
         run: docker build -f services/${{ matrix.service }}/Dockerfile -t qaroom/${{ matrix.service }}:${{ github.sha }} .
 
diff --git a/.github/workflows/reviewer-agents.yml b/.github/workflows/reviewer-agents.yml
index 5ce757f..317bbe6 100644
--- a/.github/workflows/reviewer-agents.yml
+++ b/.github/workflows/reviewer-agents.yml
@@ -31,7 +31,7 @@ jobs:
     if: ${{ !github.event.pull_request.draft && github.actor != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-workspace
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 0acf0ed..3698b81 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -104,8 +104,8 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
       - name: Install Semgrep (pinned — bump deliberately)
@@ -116,7 +116,7 @@ jobs:
         run: semgrep scan --config=p/ci --sarif --output=semgrep.sarif --metrics=off
       - name: Upload SARIF to the code-scanning Security tab (best-effort)
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
         with:
           sarif_file: semgrep.sarif
           category: semgrep
@@ -138,7 +138,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install osv-scanner (pinned — bump deliberately; mirrors the kubeconform install)
         run: |
           curl -sSL https://github.com/google/osv-scanner/releases/download/v2.4.0/osv-scanner_linux_amd64 \
@@ -150,7 +150,7 @@ jobs:
         run: '"$RUNNER_TEMP/osv-scanner" scan --recursive --format sarif ./ > osv-scanner.sarif'
       - name: Upload SARIF to the code-scanning Security tab (best-effort)
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
         with:
           sarif_file: osv-scanner.sarif
           category: osv-scanner
@@ -172,7 +172,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
         with:
           version: v4.1.1
@@ -195,7 +195,7 @@ jobs:
           soft_fail: true
       - name: Upload SARIF to the code-scanning Security tab (best-effort)
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
         with:
           sarif_file: results.sarif
           category: checkov
@@ -216,7 +216,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Generate an SPDX SBOM with Syft (anchore/sbom-action)
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
         with: