diff --git a/.github/workflows/benchmark-compare.yml b/.github/workflows/benchmark-compare.yml
index a56e891..a2e01de 100644
--- a/.github/workflows/benchmark-compare.yml
+++ b/.github/workflows/benchmark-compare.yml
@@ -109,7 +109,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ inputs.language == 'rust' }}
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 6989751..7255439 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -111,7 +111,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ inputs.language == 'rust' }}
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed7d83c..0e2912f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,7 +68,7 @@ jobs:
           python-version: "3.13"
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Stated, not inherited -- and it does change something. The pinned
@@ -124,7 +124,7 @@ jobs:
           python-version: "3.13"
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Stated, not inherited -- and it does change something. The pinned
@@ -299,7 +299,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
@@ -396,7 +396,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
diff --git a/.github/workflows/coverage-gate.yml b/.github/workflows/coverage-gate.yml
index 1dd8194..6571e84 100644
--- a/.github/workflows/coverage-gate.yml
+++ b/.github/workflows/coverage-gate.yml
@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload to Codecov
         if: ${{ inputs.use_codecov }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4  # v7.1.0
         with:
           token: ${{ secrets.codecov_token }}
           files: ${{ inputs.files }}
diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml
index 097248e..01a6988 100644
--- a/.github/workflows/docs-quality.yml
+++ b/.github/workflows/docs-quality.yml
@@ -75,7 +75,7 @@ jobs:
 
       - name: Spell check (typos)
         if: ${{ inputs.typos }}
-        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3  # v1.50.0
+        uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b  # v1.50.1
         with:
           files: ${{ inputs.typos_files }}
 
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index d03ce00..5962d4a 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 
diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml
index 8c04bc7..d7662be 100644
--- a/.github/workflows/iac-scan.yml
+++ b/.github/workflows/iac-scan.yml
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e  # v12.3122.0
+        uses: bridgecrewio/checkov-action@a8664e3a0549367977f0cda990a34311835c87c0  # v12.3123.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index 8403287..195194c 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -64,7 +64,7 @@ jobs:
 
       - name: Set up Java
         if: ${{ !inputs.use_preinstalled_toolchain }}
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.distribution }}
diff --git a/.github/workflows/kotlin-android-ci.yml b/.github/workflows/kotlin-android-ci.yml
index 2264487..9ff99d4 100644
--- a/.github/workflows/kotlin-android-ci.yml
+++ b/.github/workflows/kotlin-android-ci.yml
@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.java_distribution }}
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index 97b1906..cdd1e84 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -82,7 +82,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # The sweep decides what maintenance debt exists; it must not
diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml
index f053ec0..9c4b6cc 100644
--- a/.github/workflows/mutation-testing.yml
+++ b/.github/workflows/mutation-testing.yml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ inputs.language == 'rust' }}
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.rust_toolchain }}
 
diff --git a/.github/workflows/nddev-security-bundle.yml b/.github/workflows/nddev-security-bundle.yml
index f14e5f6..bbe0c88 100644
--- a/.github/workflows/nddev-security-bundle.yml
+++ b/.github/workflows/nddev-security-bundle.yml
@@ -116,7 +116,7 @@ jobs:
             "$source_root/scripts/run_private_security_bundle.sh" >> "$GITHUB_ENV"
 
       - name: Set up pinned uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           enable-cache: false
@@ -169,7 +169,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor
diff --git a/.github/workflows/private-static.yml b/.github/workflows/private-static.yml
index 50d10a1..1a57e8b 100644
--- a/.github/workflows/private-static.yml
+++ b/.github/workflows/private-static.yml
@@ -110,7 +110,7 @@ jobs:
 
       - name: Set up uv
         if: ${{ inputs.setup_uv }}
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: ${{ inputs.uv_version }}
           # uv provisions our pinned tooling here, not the caller's
diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml
index 181033d..9bcc5cd 100644
--- a/.github/workflows/public-codeql.yml
+++ b/.github/workflows/public-codeql.yml
@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}
diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml
index ed8a496..e5d16f1 100644
--- a/.github/workflows/public-scorecard.yml
+++ b/.github/workflows/public-scorecard.yml
@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index ed7943f..caa32fa 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -108,7 +108,7 @@ jobs:
 
       - name: Set up uv and Python
         if: ${{ inputs.package_manager == 'uv' && !inputs.use_preinstalled_toolchain }}
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: ${{ inputs.uv_version }}
           enable-cache: true
diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml
index a00d815..f50ab12 100644
--- a/.github/workflows/qt-ci.yml
+++ b/.github/workflows/qt-ci.yml
@@ -98,7 +98,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a70d1fb..c45e7ee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -77,7 +77,7 @@ jobs:
           update-environment: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # setup-uv caches by default. On a publishing workflow that turns the
diff --git a/.github/workflows/runtime-fixtures-languages.yml b/.github/workflows/runtime-fixtures-languages.yml
index 07d40b4..f4eb3f8 100644
--- a/.github/workflows/runtime-fixtures-languages.yml
+++ b/.github/workflows/runtime-fixtures-languages.yml
@@ -500,7 +500,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -544,7 +544,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -586,7 +586,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
         with:
           java-version: '21'
           distribution: temurin
@@ -601,7 +601,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
@@ -660,7 +660,7 @@ jobs:
           python-version: '3.13'
           update-environment: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           # Pinned, not inherited: setup-uv's `version` defaults to the
           # version in pyproject.toml or, absent one, whatever is latest.
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 4ac9803..9f4bace 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -84,7 +84,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
           components: ${{ inputs.components }}
@@ -131,7 +131,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
 
@@ -163,7 +163,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
           components: rustfmt
@@ -196,7 +196,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
           components: clippy
@@ -229,7 +229,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up MSRV toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.msrv_toolchain }}
 
diff --git a/.github/workflows/rust-supply-chain.yml b/.github/workflows/rust-supply-chain.yml
index ffa149f..9663576 100644
--- a/.github/workflows/rust-supply-chain.yml
+++ b/.github/workflows/rust-supply-chain.yml
@@ -97,11 +97,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-audit
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
+        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -120,11 +120,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-machete
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
+        uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375  # v2.87.12
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete
diff --git a/.github/workflows/semgrep-ci.yml b/.github/workflows/semgrep-ci.yml
index d40da72..15a965b 100644
--- a/.github/workflows/semgrep-ci.yml
+++ b/.github/workflows/semgrep-ci.yml
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # uv provisions our pinned analyser here, not the caller's
diff --git a/.github/workflows/sql-ci.yml b/.github/workflows/sql-ci.yml
index 5e8aaf5..54776c6 100644
--- a/.github/workflows/sql-ci.yml
+++ b/.github/workflows/sql-ci.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # uv provisions our pinned tooling here, not the caller's
diff --git a/.github/workflows/zizmor-no-sarif.yml b/.github/workflows/zizmor-no-sarif.yml
index b3075de..495847f 100644
--- a/.github/workflows/zizmor-no-sarif.yml
+++ b/.github/workflows/zizmor-no-sarif.yml
@@ -56,7 +56,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # Consumer-facing gate. uv provisions our pinned analyser here,
diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml
index 31d47c7..20ceb6e 100644
--- a/.github/workflows/zizmor-sarif.yml
+++ b/.github/workflows/zizmor-sarif.yml
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           version: 0.11.30
           # This workflow backs the `zizmor` job, which is in `ci-gate.needs`.
@@ -82,7 +82,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: zizmor.sarif
           category: zizmor