diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be998f6..3254712 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
       - name: Restore locked dependencies
@@ -32,7 +32,7 @@ jobs:
         run: dotnet run --project tools/PostgreSqlMcp.Build -c Release -- package --output artifacts/packages
       - name: Install and exercise both distributions
         run: dotnet run --project tools/PostgreSqlMcp.Verify -c Release -- packages --artifacts artifacts/packages
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: packages
           path: |
@@ -79,7 +79,7 @@ jobs:
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
       - run: dotnet restore postgresql-sharp-mcp.slnx --locked-mode
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1b22a85..edc532d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -51,7 +51,7 @@ jobs:
         with:
           output: artifacts/codeql
           category: /language:${{ matrix.language }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: codeql-trusted-${{ matrix.language }}
@@ -96,7 +96,7 @@ jobs:
           upload-database: false
           output: artifacts/codeql
           category: /language:${{ matrix.language }}
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: codeql-${{ matrix.revision }}-${{ matrix.language }}
@@ -121,19 +121,19 @@ jobs:
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codeql-baseline-csharp
           path: artifacts/baseline/csharp
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codeql-candidate-csharp
           path: artifacts/candidate/csharp
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codeql-baseline-actions
           path: artifacts/baseline/actions
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codeql-candidate-actions
           path: artifacts/candidate/actions
@@ -168,7 +168,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codeql-candidate-${{ matrix.language }}
           path: ${{ runner.temp }}/codeql-candidate
diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml
index 5d331e5..e72e704 100644
--- a/.github/workflows/container-security.yml
+++ b/.github/workflows/container-security.yml
@@ -48,7 +48,7 @@ jobs:
             postgresql-sharp-mcp:security
       - name: Preserve vulnerability report, including failed gates
         if: ${{ always() && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: container-security-${{ github.run_id }}-${{ github.run_attempt }}
           path: artifacts/container-security/trivy.json
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index 3ef53bf..11f837e 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -27,7 +27,7 @@ jobs:
         env:
           FUZZ_SECONDS: ${{ github.event_name == 'schedule' && '300' || '60' }}
         run: dotnet run --project tools/PostgreSqlMcp.Fuzz -c Release -p:RestoreLockedMode=true -- campaign "$FUZZ_SECONDS"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: sql-fuzz-corpus-and-failures
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d58cfdb..b868675 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,7 +43,7 @@ jobs:
         run: dotnet run --project tools/PostgreSqlMcp.Release -c Release -- validate-tag
       - name: Build trusted main publication tooling
         run: dotnet publish tools/PostgreSqlMcp.Release -c Release -p:RestoreLockedMode=true -o "$RUNNER_TEMP/release-tool"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         id: tool
         with:
           name: release-tool
@@ -71,12 +71,12 @@ jobs:
         with:
           dotnet-version: '10.0.x'
       - name: Download trusted main publication tooling
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.preflight.outputs.tool_artifact_id }}
           path: release-tool
           digest-mismatch: error
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
       - run: dotnet restore postgresql-sharp-mcp.slnx --locked-mode
@@ -95,7 +95,7 @@ jobs:
         run: dotnet release-tool/PostgreSqlMcp.Release.dll sbom
       - name: Generate internal publication context
         run: dotnet release-tool/PostgreSqlMcp.Release.dll context
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-artifacts
           path: |
@@ -105,7 +105,7 @@ jobs:
             artifacts/sbom/bom.json
             artifacts/SHA256SUMS
           if-no-files-found: error
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-context
           path: artifacts/publication-context.json
@@ -136,7 +136,7 @@ jobs:
             artifacts/sbom/bom.json
             artifacts/SHA256SUMS
       - name: Keep the provenance bundle for the GitHub Release
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-provenance
           path: ${{ steps.attest.outputs.bundle-path }}
@@ -158,7 +158,7 @@ jobs:
         with:
           dotnet-version: '10.0.x'
       - name: Download trusted main publication tooling
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.preflight.outputs.tool_artifact_id }}
           path: release-tool
@@ -195,7 +195,7 @@ jobs:
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.15.0'
       - name: Install reviewed npm CLI with staged-publishing support
@@ -213,7 +213,7 @@ jobs:
           echo "$RUNNER_TEMP/npm-bin" >> "$GITHUB_PATH"
           "$RUNNER_TEMP/npm-bin/npm" --version
       - name: Download trusted main publication tooling
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.preflight.outputs.tool_artifact_id }}
           path: release-tool
@@ -248,7 +248,7 @@ jobs:
         with:
           dotnet-version: '10.0.x'
       - name: Download trusted main publication tooling
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.preflight.outputs.tool_artifact_id }}
           path: release-tool
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index aeb9e03..4bbc3f5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           sarif_file: results.sarif
           category: scorecard
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: scorecard-findings
           path: results.sarif