diff --git a/.github/workflows/build-wasm.yml b/.github/workflows/build-wasm.yml
index 7da4d92..bd912e4 100644
--- a/.github/workflows/build-wasm.yml
+++ b/.github/workflows/build-wasm.yml
@@ -49,7 +49,7 @@ jobs:
           # Pinned (not `stable`) so the published wasm artifact doesn't drift
           # with the runner's toolchain; bump deliberately alongside the
           # size-budget check in scripts/build.sh.
-          toolchain: 1.97.1
+          toolchain: 1.99.0
           targets: wasm32-unknown-unknown
 
       - name: Install wasm-bindgen + wasm-opt (pinned prebuilts, checksummed)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ea4bce..65a8007 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,7 +114,7 @@ jobs:
       # id-token: write, so no stored secret. Forks never attempt OIDC and upload
       # tokenless; "Token required" on a same-repo run means OIDC did not mint.
       - name: Upload coverage
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         continue-on-error: true
         with:
           files: ./packages/cachekit/coverage/lcov.info
@@ -292,7 +292,7 @@ jobs:
           # Pinned (not `stable`) so the published wasm artifact doesn't drift
           # with the runner's toolchain; bump deliberately alongside the
           # size-budget check in scripts/build.sh.
-          toolchain: 1.97.1
+          toolchain: 1.99.0
           targets: wasm32-unknown-unknown
 
       - name: Cache Rust build artifacts
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 10df8ae..dcdb887 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -46,7 +46,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -246,7 +246,7 @@ jobs:
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable
         with:
-          toolchain: 1.97.1
+          toolchain: 1.99.0
           targets: wasm32-unknown-unknown
 
       - name: Install wasm-bindgen + wasm-opt (pinned prebuilts, checksummed)