diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml
index ee48c382..df7e06d0 100644
--- a/.github/workflows/container-scan.yml
+++ b/.github/workflows/container-scan.yml
@@ -34,10 +34,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0
         with:
           # renovate: datasource=python-version depName=python
           python-version: '3.14.4'
@@ -60,7 +60,7 @@ jobs:
       - name: Upload Trivy SARIF to GitHub Security tab
         id: upload_trivy
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.TRIVY_SCA_SARIF_OUTPUT }}
           category: trivy-container-scanning
@@ -68,7 +68,7 @@ jobs:
       - name: Upload OSV Scanner SARIF to GitHub Security tab
         id: upload_osv
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.OSV_SCA_SARIF_OUTPUT }}
           category: osv-scanner-container-scanning
@@ -76,7 +76,7 @@ jobs:
       - name: Upload OpenGrep SARIF to GitHub Security tab
         id: upload_opengrep
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.OPENGREP_SAST_SARIF_OUTPUT }}
           category: opengrep-sast
@@ -84,7 +84,7 @@ jobs:
       - name: Upload Hadolint SARIF to GitHub Security tab
         id: upload_hadolint
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.HADOLINT_SAST_SARIF_OUTPUT }}
           category: hadolint-sast
diff --git a/.github/workflows/publish_images.yml b/.github/workflows/publish_images.yml
index f3a69c61..c027c4c5 100644
--- a/.github/workflows/publish_images.yml
+++ b/.github/workflows/publish_images.yml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c #v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e #v4.3.0
 
       - name: Harbor connectivity probe
         run: |
@@ -36,7 +36,7 @@ jobs:
           sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c #v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f #v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml
index d086bb2b..188fabe0 100644
--- a/.github/workflows/sast.yml
+++ b/.github/workflows/sast.yml
@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0
         with:
           # renovate: datasource=python-version depName=python
           python-version: '3.14.4'
@@ -41,7 +41,7 @@ jobs:
       - name: Upload Semgrep SARIF to GitHub Security tab
         id: upload_semgrep
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.OPENGREP_SARIF_OUTPUT }}
           category: semgrep-app
diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml
index 96dd3740..efdf3ee3 100644
--- a/.github/workflows/sca.yml
+++ b/.github/workflows/sca.yml
@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0
         with:
           # renovate: datasource=python-version depName=python
           python-version: '3.14.4'
@@ -50,7 +50,7 @@ jobs:
       - name: Upload Trivy SARIF to GitHub Security tab
         id: upload_trivy
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.TRIVY_SARIF_OUTPUT }}
           category: trivy-app
@@ -58,7 +58,7 @@ jobs:
       - name: Upload OSV Scanner SARIF to GitHub Security tab
         id: upload_osv
         if: always()
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
         with:
           sarif_file: ${{ env.OSV_SARIF_OUTPUT }}
           category: osv-scanner-app
diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml
index cd8bb584..a89f156e 100644
--- a/.github/workflows/secrets-scan.yml
+++ b/.github/workflows/secrets-scan.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install gitleaks
         run: bash ci/setup-tools.sh --install-tool gitleaks
@@ -34,7 +34,7 @@ jobs:
 
       - name: Upload SARIF to code scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 #v2.25.6
+        uses: github/codeql-action/upload-sarif@5584cec5894a031d9021665d6df20e6c38e7a266 #v2.25.6
         with:
           sarif_file: ${{ env.GITLEAKS_SARIF_OUTPUT }}
           category: gitleaks