diff --git a/.github/actions/1password-secret-sync/action.yml b/.github/actions/1password-secret-sync/action.yml
index 4c3b427..57856d9 100644
--- a/.github/actions/1password-secret-sync/action.yml
+++ b/.github/actions/1password-secret-sync/action.yml
@@ -37,7 +37,7 @@ runs:
   steps:
     - name: Install 1Password CLI
       # Pin to commit SHA for supply chain security — update when action changes
-      uses: 1password/install-cli-action@9a0c9dd934086b7ab1d90115d455bda1c53c2bdb # v2.0.2
+      uses: 1password/install-cli-action@1a3160d5e9de1ae0803eaa08a88746f5ae3daa50 # v4.1.0
 
     - name: Sync secrets
       id: sync
diff --git a/.github/actions/checkout-as-app/action.yml b/.github/actions/checkout-as-app/action.yml
index dcd77de..d141141 100644
--- a/.github/actions/checkout-as-app/action.yml
+++ b/.github/actions/checkout-as-app/action.yml
@@ -143,7 +143,7 @@ runs:
     # ── Step 2: Checkout with app token baked into the remote URL ──
     - name: Checkout repository as GitHub App
       id: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         token: ${{ steps.auth.outputs.token }}
         repository: ${{ inputs.repository }}
diff --git a/.github/actions/github-app-auth/action.yml b/.github/actions/github-app-auth/action.yml
index eba0889..9385f56 100644
--- a/.github/actions/github-app-auth/action.yml
+++ b/.github/actions/github-app-auth/action.yml
@@ -50,7 +50,7 @@ runs:
   steps:
     - name: Generate GitHub App token
       id: app-token
-      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
@@ -94,7 +94,7 @@ runs:
 
     - name: Configure repo checkout token
       if: inputs.skip-checkout != 'true'
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       with:
         token: ${{ steps.app-token.outputs.token }}
         clean: false
diff --git a/.github/actions/lint-syft/action.yml b/.github/actions/lint-syft/action.yml
index b5c4b4d..b85e626 100644
--- a/.github/actions/lint-syft/action.yml
+++ b/.github/actions/lint-syft/action.yml
@@ -12,7 +12,7 @@ runs:
         echo "SBOM generated: syft-sbom.json"
 
     - name: Upload SBOM artifact
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: syft-sbom
         path: syft-sbom.json
diff --git a/.github/actions/lint-trivy/action.yml b/.github/actions/lint-trivy/action.yml
index 858cf88..003c5fd 100644
--- a/.github/actions/lint-trivy/action.yml
+++ b/.github/actions/lint-trivy/action.yml
@@ -17,7 +17,7 @@ runs:
         trivy fs . --format cyclonedx --output trivy-sbom.json
 
     - name: Upload SBOM artifact
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: trivy-sbom
         path: trivy-sbom.json
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 4d6e6fd..0437d70 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -22,7 +22,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -46,7 +46,7 @@ jobs:
           echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
 
       - name: Install mise
-        uses: jdx/mise-action@v2
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4
 
       - name: Run format
         id: format
@@ -88,12 +88,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Install mise and tools
-        uses: jdx/mise-action@v2
+        uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4
         with:
           install_args: 'grype trivy syft gitleaks trufflehog checkov aqua:secretlint/secretlint'
 
diff --git a/.github/workflows/pages.yaml b/.github/workflows/pages.yaml
index 59feb1d..ee164fc 100644
--- a/.github/workflows/pages.yaml
+++ b/.github/workflows/pages.yaml
@@ -33,16 +33,16 @@ jobs:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
 
       - name: Upload pages/ artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: pages
 
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
diff --git a/.github/workflows/sync-main-to-edge.yaml b/.github/workflows/sync-main-to-edge.yaml
index c4a6e96..167a7df 100644
--- a/.github/workflows/sync-main-to-edge.yaml
+++ b/.github/workflows/sync-main-to-edge.yaml
@@ -43,7 +43,7 @@ jobs:
       has_targets: ${{ steps.plan.outputs.has_targets }}
     steps:
       - name: Checkout caller repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -122,7 +122,7 @@ jobs:
 
       - name: Checkout target branch
         if: steps.check.outputs.exists == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ matrix.target }}
           persist-credentials: false
diff --git a/.github/workflows/sync-plugin-specs.yaml b/.github/workflows/sync-plugin-specs.yaml
index 4553029..2f1e1ae 100644
--- a/.github/workflows/sync-plugin-specs.yaml
+++ b/.github/workflows/sync-plugin-specs.yaml
@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}