diff --git a/.github/actions/prose-gate/action.yml b/.github/actions/prose-gate/action.yml
index d44bcab6..99bffb5f 100644
--- a/.github/actions/prose-gate/action.yml
+++ b/.github/actions/prose-gate/action.yml
@@ -43,7 +43,7 @@ runs:
         } >> "$GITHUB_OUTPUT"
 
     - name: Setup uv step
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       with:
         enable-cache: false
 
diff --git a/.github/actions/pypi-build-default/action.yml b/.github/actions/pypi-build-default/action.yml
index 28467b68..a960ae64 100644
--- a/.github/actions/pypi-build-default/action.yml
+++ b/.github/actions/pypi-build-default/action.yml
@@ -36,7 +36,7 @@ runs:
         exit 1
 
     - name: Setup uv step
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       with:
         version: ${{ inputs.uv-version }}
         enable-cache: true
diff --git a/.github/actions/validate/action.yml b/.github/actions/validate/action.yml
index 58822124..7b8edd8c 100644
--- a/.github/actions/validate/action.yml
+++ b/.github/actions/validate/action.yml
@@ -18,7 +18,7 @@ runs:
         python3 spec/validate.py
 
     - name: Setup uv step
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       with:
         python-version: "3.13"
 
diff --git a/.github/workflows/build-docker-task.yml b/.github/workflows/build-docker-task.yml
index 0ff11dcb..e29a30b7 100644
--- a/.github/workflows/build-docker-task.yml
+++ b/.github/workflows/build-docker-task.yml
@@ -180,7 +180,7 @@ jobs:
           fi
 
       - name: Login to Docker Hub step
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -240,7 +240,7 @@ jobs:
           fi
 
       - name: Login to Docker Hub step
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
diff --git a/.github/workflows/canonical-review-sweep.yml b/.github/workflows/canonical-review-sweep.yml
index aa72f967..3531a5e7 100644
--- a/.github/workflows/canonical-review-sweep.yml
+++ b/.github/workflows/canonical-review-sweep.yml
@@ -43,7 +43,7 @@ jobs:
       # It also imports datetime.UTC at module level.
       # So the interpreter is pinned to the floor spec/host-tools.json declares, rather than left as whatever the runner image ships.
       - name: Setup uv step
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/test-pull-request.yml b/.github/workflows/test-pull-request.yml
index 587d8ed7..892655e6 100644
--- a/.github/workflows/test-pull-request.yml
+++ b/.github/workflows/test-pull-request.yml
@@ -38,13 +38,13 @@ jobs:
           persist-credentials: false
 
       - name: Setup python step
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
 
       # The repo gate's action reader falls back to uvx, a declared host tool, where PyYAML does not import.
       - name: Setup uv step
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           ignore-nothing-to-cache: true
 
diff --git a/.github/workflows/validate-task.yml b/.github/workflows/validate-task.yml
index 30e183f9..6a53138c 100644
--- a/.github/workflows/validate-task.yml
+++ b/.github/workflows/validate-task.yml
@@ -299,7 +299,7 @@ jobs:
       # This is the one place the fleet's uvx tools are pinned or floated, decided here.
       - name: Setup uv step
         if: steps.python.outputs.any == 'true' || hashFiles('.github/actions/**/action.yml', '.github/actions/**/action.yaml') != ''
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: "3.13"
 
@@ -635,7 +635,7 @@ jobs:
       # A root the undeclared default skips still sets uv up, so an empty cache is a normal outcome rather than an error at post-job save.
       - name: Setup uv step
         if: steps.python.outputs.any == 'true'
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           python-version: ${{ matrix.python-version || fromJSON(inputs.python-versions)[0] }}
           ignore-nothing-to-cache: true