diff --git a/.github/workflows/a11y.yaml b/.github/workflows/a11y.yaml
index f9caf39..1528f55 100644
--- a/.github/workflows/a11y.yaml
+++ b/.github/workflows/a11y.yaml
@@ -36,7 +36,7 @@ jobs:
     permissions:
       contents: read # Clone the repository for package.json and the pa11y config
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -45,12 +45,12 @@ jobs:
           persist-credentials: false
 
       - name: Download built site
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.artifact }}
           path: public
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
diff --git a/.github/workflows/auto-labeler.yaml b/.github/workflows/auto-labeler.yaml
index 964cc97..aedab4e 100644
--- a/.github/workflows/auto-labeler.yaml
+++ b/.github/workflows/auto-labeler.yaml
@@ -18,7 +18,7 @@ jobs:
       contents: read # Read the release-drafter config
       pull-requests: write # Apply labels to the pull request
       issues: write # Create labels referenced in the config but missing from the repo
-    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@038160c3e14227cf7c1a7387217ac1623a969f0c # v2.1.1
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@690dbbefe65f0c1d68c5211dd6ff997f533099b5 # v2.2.0
     with:
       config-name: release-drafter.yml
     secrets:
diff --git a/.github/workflows/cloudflare-pages-deploy.yaml b/.github/workflows/cloudflare-pages-deploy.yaml
index 6bc2d9c..a3b4da3 100644
--- a/.github/workflows/cloudflare-pages-deploy.yaml
+++ b/.github/workflows/cloudflare-pages-deploy.yaml
@@ -55,7 +55,7 @@ jobs:
     permissions:
       contents: read # Check out functions/ when deploying Pages Functions
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -69,7 +69,7 @@ jobs:
           sparse-checkout: functions
 
       - name: Download built site
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.artifact }}
           path: site
diff --git a/.github/workflows/hugo-ci.yaml b/.github/workflows/hugo-ci.yaml
index 3761ef5..1ad4a81 100644
--- a/.github/workflows/hugo-ci.yaml
+++ b/.github/workflows/hugo-ci.yaml
@@ -46,7 +46,7 @@ jobs:
     permissions:
       contents: read # Clone the repository
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
@@ -59,7 +59,7 @@ jobs:
 
       - name: Setup Node
         if: inputs.prepare-command != ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
 
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload built site
         if: inputs.upload-artifact != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.upload-artifact }}
           path: public/
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 7ba3e98..f6a00af 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read # Clone the repository
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/mark-ready.yaml b/.github/workflows/mark-ready.yaml
index 7802278..d00608c 100644
--- a/.github/workflows/mark-ready.yaml
+++ b/.github/workflows/mark-ready.yaml
@@ -28,7 +28,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 45567a4..85155f5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write # Create releases and push tags
       pull-requests: read # Read PR labels for release-drafter
-    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-minimal.yaml@038160c3e14227cf7c1a7387217ac1623a969f0c # v2.1.1
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-minimal.yaml@690dbbefe65f0c1d68c5211dd6ff997f533099b5 # v2.2.0
     with:
       release-config-name: release-drafter.yml
       publish: true
diff --git a/.github/workflows/resolve-deploy-run.yaml b/.github/workflows/resolve-deploy-run.yaml
index b06e8f1..665e437 100644
--- a/.github/workflows/resolve-deploy-run.yaml
+++ b/.github/workflows/resolve-deploy-run.yaml
@@ -41,7 +41,7 @@ jobs:
       sha: ${{ steps.resolve.outputs.sha }}
       run-id: ${{ steps.resolve.outputs.run-id }}
     steps:
-      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit