diff --git a/.github/workflows/decision-brief.yml b/.github/workflows/decision-brief.yml
index 2695a4099..ff407964b 100644
--- a/.github/workflows/decision-brief.yml
+++ b/.github/workflows/decision-brief.yml
@@ -168,7 +168,7 @@ jobs:
 
       - name: Upload dry-run dispatch log
         if: ${{ env.DRY_RUN == '1' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: decision-brief-sweep-dry-run
           path: ${{ runner.temp }}/dry-run.jsonl
@@ -285,7 +285,7 @@ jobs:
         # are public, so unauthenticated reads still work for extra grounding.
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        uses: anthropics/claude-code-action@6c690188da61cf16ee7debb28383ba67f02abb4c # v1.0.242
+        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -382,7 +382,7 @@ jobs:
         # the model step could have changed in this workspace (scripts, env)
         # reaches the privileged steps.
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: decision-brief-${{ steps.gather.outputs.slug || 'package' }}
           path: |
@@ -433,7 +433,7 @@ jobs:
           fi
 
       - name: Download the drafted package
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: decision-brief-${{ env.SLUG }}
           path: ${{ runner.temp }}/landing
@@ -492,7 +492,7 @@ jobs:
 
       - name: Upload dry-run PR log
         if: ${{ env.DRY_RUN == '1' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: decision-brief-${{ env.SLUG }}-dry-run
           path: ${{ runner.temp }}/dry-run.jsonl
diff --git a/.github/workflows/idea-triage.yml b/.github/workflows/idea-triage.yml
index 9790075c0..e095e8f39 100644
--- a/.github/workflows/idea-triage.yml
+++ b/.github/workflows/idea-triage.yml
@@ -121,7 +121,7 @@ jobs:
       - name: Rank ripeness and refresh the queue
         env:
           GH_TOKEN: ${{ env.TARGET_GH_TOKEN }}
-        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1.0.248
+        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # CRITICAL (same gotcha as initiative-planner): pass the target-repo
diff --git a/.github/workflows/initiative-planner.yml b/.github/workflows/initiative-planner.yml
index 0a5bbb1ef..d99cfffc7 100644
--- a/.github/workflows/initiative-planner.yml
+++ b/.github/workflows/initiative-planner.yml
@@ -264,7 +264,7 @@ jobs:
         env:
           # Bob materializes the epic + DAG in the TARGET repo via apply-plan.sh.
           GH_TOKEN: ${{ env.TARGET_GH_TOKEN }}
-        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1.0.248
+        uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # CRITICAL (same gotcha as feature-ideation): pass the target-repo write
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 42e969c4a..679852a26 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -46,7 +46,7 @@ jobs:
           fetch-depth: 0
       - name: Set up JDK 21
         id: setup_java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'