diff --git a/.github/workflows/api-compat.yml b/.github/workflows/api-compat.yml
index a2e383e..bdea85e 100644
--- a/.github/workflows/api-compat.yml
+++ b/.github/workflows/api-compat.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: '3.13'
       - run: python tools/check_public_api.py
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index e8d043f..f462451 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -15,7 +15,7 @@ jobs:
       - run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DLS_BUILD_TESTS=OFF -DLS_BUILD_BENCHMARKS=ON
       - run: cmake --build build --parallel
       - run: build/latch-benchmark | tee benchmark.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: benchmark-${{ github.sha }}
           path: benchmark.json
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8f2977..b1089b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
         run: |
           archive=$(find . -maxdepth 1 -name 'laststate-latch-*.zip' -print -quit)
           python tools/test_cpack_archive.py "$archive" --consumer tests/package --config ${{ matrix.build_type }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: latch-${{ matrix.os }}-${{ matrix.cc }}
           path: laststate-latch-*
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b7b3e77..a3ddd94 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,12 +23,12 @@ jobs:
             build_mode: none
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build_mode }}
       - if: matrix.language == 'c-cpp'
         run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DLS_BUILD_TESTS=ON -DLS_BUILD_LINUX=ON && cmake --build build --parallel
-      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/compact-prod.yml b/.github/workflows/compact-prod.yml
index 7cebc33..6a85e3e 100644
--- a/.github/workflows/compact-prod.yml
+++ b/.github/workflows/compact-prod.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.13"
       - name: Create compact source distribution
@@ -25,7 +25,7 @@ jobs:
           cmake -S build/latch-production -B build/compact-check -G Ninja -DCMAKE_BUILD_TYPE=Release -DLS_BUILD_TESTS=ON
           cmake --build build/compact-check --parallel
           ctest --test-dir build/compact-check --output-on-failure --timeout 120
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: latch-compact-source
           path: build/latch-production
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9038f36..81d3906 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -42,7 +42,7 @@ jobs:
           files: coverage.info
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage
           path: |
diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index 0eb711e..99ef352 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -49,7 +49,7 @@ jobs:
           python tools/measure_footprint.py build/arm-cortex-m4-small/liblatch.a \
             --tool arm-none-eabi-size --label cortex-m4-small-static-archive \
             --format json --output build/footprints/cortex-m4-small.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: cortex-m4-footprints
           path: build/footprints/*.json
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 294127d..465860a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: '3.13'
       - run: python tools/check_docs.py
diff --git a/.github/workflows/emulator-stress.yml b/.github/workflows/emulator-stress.yml
index 6a7e30c..2a6d80c 100644
--- a/.github/workflows/emulator-stress.yml
+++ b/.github/workflows/emulator-stress.yml
@@ -54,7 +54,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: '3.12'
       - name: Install gcc-riscv64-unknown-elf
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 48cdf2b..d34860a 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -37,7 +37,7 @@ jobs:
       - run: build/fuzz-compression corpus/compression -artifact_prefix=artifacts/ -max_total_time="${FUZZ_SECONDS}" -timeout=5
       - run: build/fuzz-aead corpus/aead -artifact_prefix=artifacts/ -max_total_time="${FUZZ_SECONDS}" -timeout=5
       - run: build/fuzz-stream corpus/stream -artifact_prefix=artifacts/ -max_total_time="${FUZZ_SECONDS}" -timeout=5
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: fuzz-corpus-and-crashes
diff --git a/.github/workflows/hil.yml b/.github/workflows/hil.yml
index 056c43f..045dc42 100644
--- a/.github/workflows/hil.yml
+++ b/.github/workflows/hil.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - name: Install hash-pinned serial dependency
@@ -34,7 +34,7 @@ jobs:
           New-Item -ItemType Directory -Force -Path hil-evidence | Out-Null
           python hil/runner.py --board "${{ inputs.board_config }}" --scenario "${{ inputs.scenario }}" `
             --commit "${{ github.sha }}" --evidence-out "hil-evidence/${{ inputs.scenario }}.json"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: hil-${{ inputs.scenario }}-${{ github.sha }}
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index c888a85..a05440a 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -49,7 +49,7 @@ jobs:
           echo "apt install failed after 3 attempts" >&2
           exit 1
       - run: python tools/mutation_campaign.py --build build/mutation-campaign --minimum-score 85 --report artifacts/mutation-report.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: mutation-report
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ff89418..7d500fe 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -31,7 +31,7 @@ jobs:
       - run: valgrind --error-exitcode=1 --leak-check=full build/latch-envelope-fuzz-tests
       - run: valgrind --error-exitcode=1 --leak-check=full build/latch-spool-stress-tests
       - run: build/latch-benchmark > benchmark.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: nightly-results
           path: benchmark.json
diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml
index 16e4ebc..793c030 100644
--- a/.github/workflows/osv.yml
+++ b/.github/workflows/osv.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Scan dependencies for known vulnerabilities
-        uses: google/osv-scanner-action/osv-scanner-action@8ac9e5ce44cc7178e0e04229a91bdcc003166e57
+        uses: google/osv-scanner-action/osv-scanner-action@9a96bc4d2b09685b6142bcfe25a3dc17cb2d7347
         with:
           scan-args: |-
             --recursive
diff --git a/.github/workflows/project-readiness.yml b/.github/workflows/project-readiness.yml
index 0a06edf..e741df3 100644
--- a/.github/workflows/project-readiness.yml
+++ b/.github/workflows/project-readiness.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: '3.13'
       - run: python tools/check_project_readiness.py
diff --git a/.github/workflows/registry-packages.yml b/.github/workflows/registry-packages.yml
index be04f1c..1c31331 100644
--- a/.github/workflows/registry-packages.yml
+++ b/.github/workflows/registry-packages.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
@@ -29,7 +29,7 @@ jobs:
       - run: pio run -d examples/platformio-link-check
       - run: pio run -d examples/arduino-avr-cooperative
       - run: cargo publish --manifest-path rust/latch/Cargo.toml --dry-run --allow-dirty
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: registry-package-candidates
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index af00eea..1f131f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: '3.13'
       - name: Require a release-metadata-matched tag reachable from prod
@@ -64,7 +64,7 @@ jobs:
       - run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DLS_BUILD_TESTS=OFF -DLS_COMMERCIAL_PROFILE=ON
       - run: cmake --build build --config Release --parallel
       - run: cpack --config build/CPackConfig.cmake -C Release
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: commercial-release-${{ matrix.os }}
           path: laststate-latch-*
@@ -78,12 +78,12 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: commercial-release-*
           path: dist
           merge-multiple: true
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: '3.13'
       - name: Create compact source archive
diff --git a/.github/workflows/required.yml b/.github/workflows/required.yml
index 10a5eda..c3c5a82 100644
--- a/.github/workflows/required.yml
+++ b/.github/workflows/required.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.13"
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c047b6b..22dab0d 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,16 +20,16 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         if: always() && hashFiles('results.sarif') != ''
         with:
           sarif_file: results.sarif
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always() && hashFiles('results.sarif') != ''
         with:
           name: openssf-scorecard
diff --git a/.github/workflows/zephyr-integrations.yml b/.github/workflows/zephyr-integrations.yml
index 2c2e7db..fcc1456 100644
--- a/.github/workflows/zephyr-integrations.yml
+++ b/.github/workflows/zephyr-integrations.yml
@@ -30,7 +30,7 @@ jobs:
     name: ${{ matrix.name }} (${{ matrix.board }})
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - uses: zephyrproject-rtos/action-zephyr-setup@be8136a8bba01580485d98b7ad2d32477c36a49a # v1
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.12"
       - uses: zephyrproject-rtos/action-zephyr-setup@be8136a8bba01580485d98b7ad2d32477c36a49a # v1