diff --git a/.github/workflows/crates.yml b/.github/workflows/crates.yml
index 250c960..1a15ee3 100644
--- a/.github/workflows/crates.yml
+++ b/.github/workflows/crates.yml
@@ -51,7 +51,7 @@ jobs:
         run: '"./$SCRIPT"'
       - if: steps.published.outputs.skip != 'true'
         id: auth
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
       - if: steps.published.outputs.skip != 'true'
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/.github/workflows/docker-dev.yml b/.github/workflows/docker-dev.yml
index 164ef26..a44688e 100644
--- a/.github/workflows/docker-dev.yml
+++ b/.github/workflows/docker-dev.yml
@@ -26,7 +26,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - id: read
         env:
           IMAGE: ghcr.io/${{ inputs.image }}
@@ -46,7 +46,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5405f02..708495d 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -51,7 +51,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - id: read
         env:
           IMAGE: ${{ inputs.image }}
@@ -70,7 +70,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
diff --git a/.github/workflows/maturin-wheels.yml b/.github/workflows/maturin-wheels.yml
index f35c385..5473266 100644
--- a/.github/workflows/maturin-wheels.yml
+++ b/.github/workflows/maturin-wheels.yml
@@ -83,7 +83,7 @@ jobs:
             echo "before=${BEFORE:+source ./$BEFORE}"
           } >> "$GITHUB_OUTPUT"
       - if: ${{ !matrix.build.container }}
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ steps.args.outputs.setup }}
           architecture: ${{ matrix.build.architecture }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f160206..6b00dea 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -65,7 +65,7 @@ jobs:
           TOKEN: ${{ secrets.registry-token }}
         run: echo "login=$([ -n "$TOKEN" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
       - if: steps.auth.outputs.login == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ inputs.registry-username }}
@@ -125,7 +125,7 @@ jobs:
           output-file: sbom/${{ github.event.repository.name }}-${{ inputs.tag }}.spdx.json
           upload-artifact: false
           upload-release-assets: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - env:
           GH_TOKEN: ${{ steps.app.outputs.token }}
           TAG: ${{ inputs.tag }}
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index ba22db0..8661036 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - env:
           SYNC_ARGS: ${{ inputs.uv-sync-args }}
         run: |
@@ -89,7 +89,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: ${{ matrix.python-version }}
       - if: inputs.secret-env != '[]'
diff --git a/.github/workflows/python-versions.yml b/.github/workflows/python-versions.yml
index 67f2037..cb373a7 100644
--- a/.github/workflows/python-versions.yml
+++ b/.github/workflows/python-versions.yml
@@ -32,7 +32,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - id: read
         env:
           ROOT: ${{ inputs.working-directory }}
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index 237ec49..1fc8864 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -70,7 +70,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - id: manifest
         env:
           ROOT: ${{ inputs.working-directory }}
diff --git a/.github/workflows/rust-tests.yml b/.github/workflows/rust-tests.yml
index e7ac343..c703bd8 100644
--- a/.github/workflows/rust-tests.yml
+++ b/.github/workflows/rust-tests.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
       # Installs the channel pinned in rust-toolchain.toml.
       - run: rustup show active-toolchain || rustup toolchain install
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: ${{ inputs.working-directory }}
       - run: cargo fmt --all -- --check
@@ -64,7 +64,7 @@ jobs:
         with:
           persist-credentials: false
       - run: rustup show active-toolchain || rustup toolchain install
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: ${{ inputs.working-directory }}
       - if: inputs.setup-script != ''
diff --git a/.github/workflows/stable-guard.yml b/.github/workflows/stable-guard.yml
index 7d1d565..12b6e03 100644
--- a/.github/workflows/stable-guard.yml
+++ b/.github/workflows/stable-guard.yml
@@ -23,7 +23,7 @@ jobs:
           ref: ${{ job.workflow_sha }}
           path: .shared
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - env:
           ROOT: ${{ inputs.working-directory }}
         run: uv run --no-project --with packaging --with pyyaml python .shared/scripts/manifest.py --root "$ROOT" release
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 452b550..20e39d2 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,5 +19,5 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - run: uv run --group dev actionlint