diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
index 7ce06568..db31a4e3 100644
--- a/.github/workflows/backend-tests.yml
+++ b/.github/workflows/backend-tests.yml
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Run runtime, migration, and export-safety tests
         run: |
diff --git a/.github/workflows/changelog-fragments-validate.yml b/.github/workflows/changelog-fragments-validate.yml
index 771ef64e..257dd641 100644
--- a/.github/workflows/changelog-fragments-validate.yml
+++ b/.github/workflows/changelog-fragments-validate.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Unit-test the fragment compiler
         run: python3 -m unittest scripts.test_build_changelog -v
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb12fece..088821f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python }}
       - name: Run repository tests
@@ -45,7 +45,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Verify generated sources and release metadata
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 972925f3..6b19a893 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,7 @@ jobs:
           upload: ${{ github.event.repository.private && 'never' || 'always' }}
       - name: Retain private-repository SARIF
         if: github.event.repository.private
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codeql-python-sarif-${{ github.sha }}
           path: ${{ steps.analyze.outputs.sarif-output }}
diff --git a/.github/workflows/compliance-trace.yml b/.github/workflows/compliance-trace.yml
index 0ff75059..3a98ae48 100644
--- a/.github/workflows/compliance-trace.yml
+++ b/.github/workflows/compliance-trace.yml
@@ -75,7 +75,7 @@ jobs:
       # success — a job-level skip of a required context would strand the PR
       # (skip-deadlock class). Keyed on the immutable PR AUTHOR, not actor.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       # dependabot[bot] carve-out (operator decision 2026-08-17, auto-merge
       # enablement): Dependabot cannot author a compliance trace, so the trace
diff --git a/.github/workflows/regression-test-skills.yml b/.github/workflows/regression-test-skills.yml
index 0ee5de0e..993d4211 100644
--- a/.github/workflows/regression-test-skills.yml
+++ b/.github/workflows/regression-test-skills.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Install deps
         run: pip install pyyaml
diff --git a/.github/workflows/release-consistency.yml b/.github/workflows/release-consistency.yml
index 46052fba..97a8df53 100644
--- a/.github/workflows/release-consistency.yml
+++ b/.github/workflows/release-consistency.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Unit-test the consistency checker
         run: python scripts/test_check_release_consistency.py
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35b0520c..71988c47 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Classify canonical public package
         id: classify
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Verify Developer ID, hardened runtime, notarization, and release matrix
         run: >-
@@ -90,7 +90,7 @@ jobs:
           --git-sha "$(git rev-parse HEAD)"
           --write-evidence /tmp/runtime-verification.json
       - name: Publish commit-bound runtime verification evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: runtime-verification
           path: /tmp/runtime-verification.json
@@ -124,15 +124,15 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: '0.12.5'
           enable-cache: false
       - name: Download macOS runtime verification evidence
         if: needs.classify-release.outputs.mode == 'activation'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: runtime-verification
           path: /tmp/runtime-verification
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index a2ad456a..ccfee7e9 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Scan tracked files for credential patterns
         run: python scripts/secret_scan.py
diff --git a/.github/workflows/skill-build-fresh.yml b/.github/workflows/skill-build-fresh.yml
index 6a9222ab..67c8eb03 100644
--- a/.github/workflows/skill-build-fresh.yml
+++ b/.github/workflows/skill-build-fresh.yml
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/validate-skills.yml b/.github/workflows/validate-skills.yml
index 3821723f..016b8d9a 100644
--- a/.github/workflows/validate-skills.yml
+++ b/.github/workflows/validate-skills.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with: { python-version: '3.12' }
       - name: Install PyYAML
         run: pip install pyyaml