diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index e8d043f..f462451 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -15,7 +15,7 @@ jobs:
       - run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DLS_BUILD_TESTS=OFF -DLS_BUILD_BENCHMARKS=ON
       - run: cmake --build build --parallel
       - run: build/latch-benchmark | tee benchmark.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmark-${{ github.sha }}
           path: benchmark.json
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8f2977..b1089b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
         run: |
           archive=$(find . -maxdepth 1 -name 'laststate-latch-*.zip' -print -quit)
           python tools/test_cpack_archive.py "$archive" --consumer tests/package --config ${{ matrix.build_type }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: latch-${{ matrix.os }}-${{ matrix.cc }}
           path: laststate-latch-*
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b7b3e77..32a1322 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,12 +23,12 @@ jobs:
             build_mode: none
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build_mode }}
       - if: matrix.language == 'c-cpp'
         run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DLS_BUILD_TESTS=ON -DLS_BUILD_LINUX=ON && cmake --build build --parallel
-      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/compact-prod.yml b/.github/workflows/compact-prod.yml
index 7cebc33..9f7b117 100644
--- a/.github/workflows/compact-prod.yml
+++ b/.github/workflows/compact-prod.yml
@@ -25,7 +25,7 @@ jobs:
           cmake -S build/latch-production -B build/compact-check -G Ninja -DCMAKE_BUILD_TYPE=Release -DLS_BUILD_TESTS=ON
           cmake --build build/compact-check --parallel
           ctest --test-dir build/compact-check --output-on-failure --timeout 120
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: latch-compact-source
           path: build/latch-production
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9038f36..81d3906 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -42,7 +42,7 @@ jobs:
           files: coverage.info
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage
           path: |
diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index 0eb711e..99ef352 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -49,7 +49,7 @@ jobs:
           python tools/measure_footprint.py build/arm-cortex-m4-small/liblatch.a \
             --tool arm-none-eabi-size --label cortex-m4-small-static-archive \
             --format json --output build/footprints/cortex-m4-small.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: cortex-m4-footprints
           path: build/footprints/*.json
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 48cdf2b..d34860a 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -37,7 +37,7 @@ jobs:
       - run: build/fuzz-compression corpus/compression -artifact_prefix=artifacts/ -max_total_time="${FUZZ_SECONDS}" -timeout=5
       - run: build/fuzz-aead corpus/aead -artifact_prefix=artifacts/ -max_total_time="${FUZZ_SECONDS}" -timeout=5
       - run: build/fuzz-stream corpus/stream -artifact_prefix=artifacts/ -max_total_time="${FUZZ_SECONDS}" -timeout=5
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: fuzz-corpus-and-crashes
diff --git a/.github/workflows/hil.yml b/.github/workflows/hil.yml
index 056c43f..861c769 100644
--- a/.github/workflows/hil.yml
+++ b/.github/workflows/hil.yml
@@ -34,7 +34,7 @@ jobs:
           New-Item -ItemType Directory -Force -Path hil-evidence | Out-Null
           python hil/runner.py --board "${{ inputs.board_config }}" --scenario "${{ inputs.scenario }}" `
             --commit "${{ github.sha }}" --evidence-out "hil-evidence/${{ inputs.scenario }}.json"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: hil-${{ inputs.scenario }}-${{ github.sha }}
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index c888a85..a05440a 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -49,7 +49,7 @@ jobs:
           echo "apt install failed after 3 attempts" >&2
           exit 1
       - run: python tools/mutation_campaign.py --build build/mutation-campaign --minimum-score 85 --report artifacts/mutation-report.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: mutation-report
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ff89418..7d500fe 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -31,7 +31,7 @@ jobs:
       - run: valgrind --error-exitcode=1 --leak-check=full build/latch-envelope-fuzz-tests
       - run: valgrind --error-exitcode=1 --leak-check=full build/latch-spool-stress-tests
       - run: build/latch-benchmark > benchmark.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: nightly-results
           path: benchmark.json
diff --git a/.github/workflows/registry-packages.yml b/.github/workflows/registry-packages.yml
index be04f1c..bbabebf 100644
--- a/.github/workflows/registry-packages.yml
+++ b/.github/workflows/registry-packages.yml
@@ -29,7 +29,7 @@ jobs:
       - run: pio run -d examples/platformio-link-check
       - run: pio run -d examples/arduino-avr-cooperative
       - run: cargo publish --manifest-path rust/latch/Cargo.toml --dry-run --allow-dirty
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: registry-package-candidates
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index af00eea..25ffbe3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,7 +64,7 @@ jobs:
       - run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DLS_BUILD_TESTS=OFF -DLS_COMMERCIAL_PROFILE=ON
       - run: cmake --build build --config Release --parallel
       - run: cpack --config build/CPackConfig.cmake -C Release
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: commercial-release-${{ matrix.os }}
           path: laststate-latch-*
@@ -78,7 +78,7 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: commercial-release-*
           path: dist
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c047b6b..e80d6f2 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,16 +20,16 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         if: always() && hashFiles('results.sarif') != ''
         with:
           sarif_file: results.sarif
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && hashFiles('results.sarif') != ''
         with:
           name: openssf-scorecard