diff --git a/.github/workflows/check.bench.yml b/.github/workflows/check.bench.yml
index 69c6dd0..1d49511 100644
--- a/.github/workflows/check.bench.yml
+++ b/.github/workflows/check.bench.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Build deterministic CPU benchmarks
         run: cargo codspeed build -p bemo --bench buffers --bench handles --bench http --locked -m simulation
       - name: Track CPU performance
-        uses: CodSpeedHQ/action@78102a468f96d8e0ccb92d0ec49425753fc42062 # v5.6.0
+        uses: CodSpeedHQ/action@af75f77f17a054769abefaa42fe8dc2975469b5f # v5.6.3
         with:
           mode: simulation
           runner-version: '5.2.1'
@@ -111,7 +111,7 @@ jobs:
       - run: cargo codspeed build -p bemo --bench tls --locked -m walltime
       - run: make bench-prepare
       - name: Track TLS and end-to-end wall time
-        uses: CodSpeedHQ/action@78102a468f96d8e0ccb92d0ec49425753fc42062 # v5.6.0
+        uses: CodSpeedHQ/action@af75f77f17a054769abefaa42fe8dc2975469b5f # v5.6.3
         with:
           mode: walltime
           runner-version: '5.2.1'
diff --git a/.github/workflows/check.jvm.yml b/.github/workflows/check.jvm.yml
index b613f8e..dd5bece 100644
--- a/.github/workflows/check.jvm.yml
+++ b/.github/workflows/check.jvm.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4
+      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
         with:
           version: '2026.9.10'
       # Keep the stock JVM test matrix authoritative after Mise's development JDK.
diff --git a/.github/workflows/check.rust.yml b/.github/workflows/check.rust.yml
index 3fec6ba..ffcd946 100644
--- a/.github/workflows/check.rust.yml
+++ b/.github/workflows/check.rust.yml
@@ -29,7 +29,7 @@ jobs:
       - name: Check generated C exports
         if: runner.os == 'Linux'
         run: python3 tools/generate_exports.py --check
-      - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4
+      - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
         if: runner.os == 'Linux'
         with:
           version: '2026.9.10'
diff --git a/.github/workflows/job.central.yml b/.github/workflows/job.central.yml
index e54708a..a9109b7 100644
--- a/.github/workflows/job.central.yml
+++ b/.github/workflows/job.central.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: v3.0.5
       - name: Verify the immutable release and its main-source provenance
diff --git a/.github/workflows/job.release.yml b/.github/workflows/job.release.yml
index b67c132..9927636 100644
--- a/.github/workflows/job.release.yml
+++ b/.github/workflows/job.release.yml
@@ -47,7 +47,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: python3 tools/release.py stage
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         if: steps.draft.outputs.tag != ''
         with:
           cosign-release: v3.0.5
diff --git a/.github/workflows/on.packages.yml b/.github/workflows/on.packages.yml
index 74ecd99..d24faec 100644
--- a/.github/workflows/on.packages.yml
+++ b/.github/workflows/on.packages.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: v3.0.5
       - name: Authenticate and publish immutable release artifacts