diff --git a/.github/workflows/check.jvm.yml b/.github/workflows/check.jvm.yml
index e3dafb8..b613f8e 100644
--- a/.github/workflows/check.jvm.yml
+++ b/.github/workflows/check.jvm.yml
@@ -16,14 +16,14 @@ jobs:
     steps:
       - name: Harden runner
         if: runner.os == 'Linux'
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
         with:
           egress-policy: audit
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
+      - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4
         with:
           version: '2026.9.10'
       # Keep the stock JVM test matrix authoritative after Mise's development JDK.
diff --git a/.github/workflows/check.native-image.yml b/.github/workflows/check.native-image.yml
index b36a1e4..d5b24b7 100644
--- a/.github/workflows/check.native-image.yml
+++ b/.github/workflows/check.native-image.yml
@@ -10,7 +10,7 @@ jobs:
     steps:
       - name: Harden runner
         if: runner.os == 'Linux'
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
         with:
           egress-policy: audit
       - name: Checkout
diff --git a/.github/workflows/check.rust.yml b/.github/workflows/check.rust.yml
index 5c5694b..3fec6ba 100644
--- a/.github/workflows/check.rust.yml
+++ b/.github/workflows/check.rust.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Harden runner
         if: runner.os == 'Linux'
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
         with:
           egress-policy: audit
       - name: Checkout
@@ -29,7 +29,7 @@ jobs:
       - name: Check generated C exports
         if: runner.os == 'Linux'
         run: python3 tools/generate_exports.py --check
-      - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
+      - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4
         if: runner.os == 'Linux'
         with:
           version: '2026.9.10'
@@ -73,7 +73,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
         with:
           egress-policy: audit
       - name: Checkout
diff --git a/.github/workflows/job.build.yml b/.github/workflows/job.build.yml
index 916f8a9..fd8d8ef 100644
--- a/.github/workflows/job.build.yml
+++ b/.github/workflows/job.build.yml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Harden runner
         if: runner.os == 'Linux'
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
         with:
           egress-policy: audit
       - name: Checkout
@@ -26,7 +26,7 @@ jobs:
         run: python3 -c 'import json; print("version=" + json.load(open("tools/versions.json"))["llvm"]["toolchain_version"])' >> "$GITHUB_OUTPUT"
       - name: Install Elide native toolchain
         id: native-toolchain
-        uses: elide-dev/toolchain/action@171eb7cde379e17822e042cfbda26c9740c10b03
+        uses: elide-dev/toolchain/action@4677dd77b520b609bb0e548e6e7a4dadadbb2d14
         with:
           version: ${{ steps.native-version.outputs.version }}
           target: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-gnu' || 'arm64-apple-darwin' }}
diff --git a/tests/sanitizer/SanitizerCanary.java b/tests/sanitizer/SanitizerCanary.java
index fb8d2d8..fd525e2 100644
--- a/tests/sanitizer/SanitizerCanary.java
+++ b/tests/sanitizer/SanitizerCanary.java
@@ -5,6 +5,7 @@
 import java.lang.foreign.ValueLayout;
 import java.lang.invoke.MethodHandle;
 import java.nio.file.Path;
+import java.util.concurrent.CountDownLatch;
 
 /** Calls a deliberately defective native library through FFM; the sanitizer must abort it. */
 public final class SanitizerCanary {
@@ -26,18 +27,24 @@ public static void main(String[] args) throws Throwable {
                 symbols.find("bemo_canary_race").orElseThrow(),
                 FunctionDescriptor.ofVoid(ValueLayout.JAVA_INT));
         Thread[] threads = new Thread[4];
+        CountDownLatch ready = new CountDownLatch(threads.length);
+        CountDownLatch start = new CountDownLatch(1);
         for (int index = 0; index < threads.length; index++) {
           threads[index] =
               Thread.ofPlatform()
                   .start(
                       () -> {
                         try {
+                          ready.countDown();
+                          start.await();
                           race.invokeExact(100_000);
                         } catch (Throwable failure) {
                           throw new AssertionError(failure);
                         }
                       });
         }
+        ready.await();
+        start.countDown();
         for (Thread thread : threads) {
           thread.join();
         }
diff --git a/tests/sanitizer/canary.c b/tests/sanitizer/canary.c
index 2e704a0..78fe904 100644
--- a/tests/sanitizer/canary.c
+++ b/tests/sanitizer/canary.c
@@ -14,7 +14,9 @@ int32_t bemo_canary_overflow(void) {
 }
 
 /* Unsynchronized counter written from several Java threads: TSAN must report it. */
-static uint64_t counter;
+/* Keep repeated loads/stores; an optimized counter += iterations can finish
+ * before the other callers enter. Volatile does not make these accesses atomic. */
+static volatile uint64_t counter;
 
 void bemo_canary_race(int32_t iterations) {
   for (int32_t index = 0; index < iterations; index++) {