diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74740fe1..f5a7241c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
       # The documentation site is npm rather than bun: Astro and Starlight are
       # exercised on npm upstream, and the lockfile is what `just site-build`
       # installs from.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.19.0
           cache: npm
@@ -141,7 +141,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.4.2
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.19.0
       - name: just ui-deps
@@ -152,7 +152,7 @@ jobs:
           FANOUT_E2E_SKIP_PERFORMANCE: ${{ matrix.skip_performance }}
       - name: Upload browser evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: browser-evidence-${{ matrix.slug }}
           path: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 02ea1418..e92bb879 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,7 +42,7 @@ jobs:
           cache: true
 
       # Go 1.27 needs CodeQL 2.26.4 or later, which v4.37.9 and newer select.
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -55,6 +55,6 @@ jobs:
       - if: matrix.build-mode == 'manual'
         run: bash scripts/with-duckdb.sh go build ./...
 
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3650fba5..9b426e5f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -117,7 +117,7 @@ jobs:
           set -euo pipefail
           got="$(./stage/fanout -version)"
           [ "${got}" = "${GITHUB_REF_NAME}" ] || { echo "version = ${got}, want ${GITHUB_REF_NAME}"; exit 1; }
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fanout_${{ matrix.goos }}_${{ matrix.goarch }}
           path: fanout_*.tar.gz
@@ -169,7 +169,7 @@ jobs:
           set -euo pipefail
           mkdir -p digests
           echo "${{ steps.build.outputs.digest }}" > "digests/${{ matrix.arch }}"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digest-${{ matrix.arch }}
           path: digests/*
@@ -188,7 +188,7 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: digests
           pattern: digest-*
@@ -281,7 +281,7 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: artifacts
           pattern: fanout_*
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index 45bf4148..a0c49047 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -67,7 +67,7 @@ jobs:
       # workflow asserted the runner's preinstalled Node instead, to avoid
       # adding a supply-chain dependency without a SHA to pin it to; the SHA is
       # the same one ci.yml uses, so the objection no longer applies.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.19.0
           cache: npm