diff --git a/.github/workflows/ios-release.yml b/.github/workflows/ios-release.yml
index 818d49176..ab684314e 100644
--- a/.github/workflows/ios-release.yml
+++ b/.github/workflows/ios-release.yml
@@ -196,7 +196,7 @@ jobs:
           echo "✅ Metal Toolchain removed"
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
         with:
           ruby-version: '3.0'
           bundler-cache: true
diff --git a/.github/workflows/preview-destroy.yml b/.github/workflows/preview-destroy.yml
index 29bb686bd..e138f7159 100644
--- a/.github/workflows/preview-destroy.yml
+++ b/.github/workflows/preview-destroy.yml
@@ -63,7 +63,7 @@ jobs:
           # the base ref anyway, but being explicit prevents accidents if
           # the trigger is ever changed.)
           ref: main
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           aws-region: us-east-1
diff --git a/.github/workflows/previews-shared-deploy.yml b/.github/workflows/previews-shared-deploy.yml
index 97cb90870..ed3ea3628 100644
--- a/.github/workflows/previews-shared-deploy.yml
+++ b/.github/workflows/previews-shared-deploy.yml
@@ -69,7 +69,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           aws-region: ${{ inputs.region || 'us-east-1' }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b1232ae9b..3adc640ae 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -60,7 +60,7 @@ jobs:
             --json-output semgrep.json
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         if: always() && hashFiles('semgrep.sarif') != ''
         continue-on-error: true
         with:
diff --git a/.github/workflows/stack-deploy.yml b/.github/workflows/stack-deploy.yml
index bb6e8d285..014bc671a 100644
--- a/.github/workflows/stack-deploy.yml
+++ b/.github/workflows/stack-deploy.yml
@@ -110,7 +110,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           aws-region: ${{ inputs.region }}
@@ -234,7 +234,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
-      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/thunder-deep-review.yml b/.github/workflows/thunder-deep-review.yml
index 20aae5e5d..c96b38b60 100644
--- a/.github/workflows/thunder-deep-review.yml
+++ b/.github/workflows/thunder-deep-review.yml
@@ -196,7 +196,7 @@ jobs:
       # ─────────────────────────────────────────────────────────────────────
       - name: thunder-deep-review (step 1 — recall pass, candidate findings)
         id: review_model
-        uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c # v1
+        uses: anthropics/claude-code-action@44423bdec74b97d67543eb16c110546762c110b2 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Pass the workflow token so the action authenticates to GitHub WITH it
@@ -398,7 +398,7 @@ jobs:
         if: >-
           steps.persist_candidates.outputs.count != '' &&
           steps.persist_candidates.outputs.count != '0'
-        uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c # v1
+        uses: anthropics/claude-code-action@44423bdec74b97d67543eb16c110546762c110b2 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
index 14ae6daf3..8f6d2eab9 100644
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Install git-cliff
         if: ${{ !inputs.nightly }}
-        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2
+        uses: taiki-e/install-action@c44f6b046f1c29ae5918b1e0bfdbb2f1813836fd # v2
         with:
           tool: git-cliff