diff --git a/.github/workflows/cf-sync.yml b/.github/workflows/cf-sync.yml
index c89559c5..b67b8c98 100644
--- a/.github/workflows/cf-sync.yml
+++ b/.github/workflows/cf-sync.yml
@@ -16,5 +16,5 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: deploy/cf-sync.sh
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 6668ade7..96750808 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: cargo build --locked --bin kloudlite
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 59c47419..3894a0be 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -39,7 +39,7 @@ jobs:
       # finds the last run's compiled tests instead of starting cold.
       CARGO_TARGET_DIR: /home/azureuser/ci-target-test
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # The VM's own toolchain (rustup in ~/.cargo); the runner service starts with a bare PATH.
       - run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       # `--all-targets`: the test targets are gated too, so a lint there is fixed in the PR that
@@ -59,7 +59,7 @@ jobs:
       # `audit-check` above covers advisories only. This adds the three checks a repo with this
       # much crypto surface wants: banned/duplicate crates, licence policy, and source
       # allowlisting. Config lives in deny.toml, next to Cargo.toml.
-      - uses: EmbarkStudios/cargo-deny-action@b66acf5e9fe20f8aba065be86778a8a4c846f902 # v2
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
         with:
           command: check
 
@@ -99,7 +99,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: >
           cargo build --release --locked
           --bin kloudlite --bin kloudlite-api --bin kloudlite-worker
@@ -115,7 +115,7 @@ jobs:
               echo "::error::$b needs $need, bookworm-slim ships 2.36"; exit 1
             fi
           done
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: bins
           path: |
@@ -143,25 +143,25 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: bins
           path: target/release
       # upload-artifact drops the mode bits and the Dockerfile COPYs the files as they are.
       - run: chmod +x target/release/kloudlite* target/release/kl
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           # The classic driver: the VM's own daemon keeps every layer between runs, which is the
           # cache `type=gha` used to stand in for.
           driver: docker
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       # No cache options: the VM's daemon caches every layer locally between runs.
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: server
@@ -171,7 +171,7 @@ jobs:
           tags: |
             ghcr.io/kloudlite/kloudlite:latest
             ghcr.io/kloudlite/kloudlite:${{ github.sha }}
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: agent
@@ -180,7 +180,7 @@ jobs:
           tags: |
             ghcr.io/kloudlite/kloudlite-agent:latest
             ghcr.io/kloudlite/kloudlite-agent:${{ github.sha }}
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: gateway
@@ -191,7 +191,7 @@ jobs:
             ghcr.io/kloudlite/kloudlite-gateway:${{ github.sha }}
       # The SLO probe. Same commit as the tier it probes, deliberately: a probe pinned behind the
       # fleet reports the previous release's journey and calls it green.
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: slo
@@ -203,7 +203,7 @@ jobs:
       # No binary of ours inside: the default workspace image is alpine plus what sshd and VS
       # Code need. Built here so it is pinned by the same SHA as the agent that renders pods
       # from it.
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: workspace
diff --git a/.github/workflows/kl.yml b/.github/workflows/kl.yml
index 72caf1a3..5c4e6d03 100644
--- a/.github/workflows/kl.yml
+++ b/.github/workflows/kl.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           targets: ${{ matrix.target }}
@@ -44,7 +44,7 @@ jobs:
           name="kl-${{ matrix.target }}"
           cp "target/${{ matrix.target }}/release/kl" "$name"
           shasum -a 256 "$name" > "$name.sha256" 2>/dev/null || sha256sum "$name" > "$name.sha256"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: kl-${{ matrix.target }}
           path: |
@@ -61,7 +61,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
           merge-multiple: true
@@ -70,10 +70,10 @@ jobs:
       # `sha256sums` proves a download is intact; this proves it came from THIS workflow on THIS
       # commit (`gh attestation verify kl-<target> -R kloudlite/kloudlite`). Free for a public
       # repo, and the only origin signal `install.sh`'s same-origin checksum cannot give.
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/kl-*
-      - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
         with:
           files: dist/*
           generate_release_notes: true
diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 49c9241b..48873878 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.14
       - name: Cache turbo
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: web/.turbo
           # Keyed on the lockfile, not the commit: a per-commit key can never hit and writes a
@@ -52,14 +52,14 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: web
           platforms: linux/amd64