diff --git a/.github/settings/actions-selected.json b/.github/settings/actions-selected.json
index 2357af7..1a35e9a 100644
--- a/.github/settings/actions-selected.json
+++ b/.github/settings/actions-selected.json
@@ -6,6 +6,7 @@
     "actions-rust-lang/setup-rust-toolchain@*",
     "astral-sh/setup-uv@*",
     "rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18",
+    "rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9",
     "codecov/codecov-action@*",
     "zizmorcore/zizmor-action@*",
     "taiki-e/cache-cargo-install-action@*",
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 58aa0f2..268c7d0 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -117,7 +117,7 @@ jobs:
             github.event_name != 'pull_request' ||
             github.event.pull_request.head.repo.full_name == github.repository
           )
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: audit-results.sarif
           category: cargo-audit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8ff4a7..739d305 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version-file: pyproject.toml
           python-version-file: .python-version
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2b807b6..73846a4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: matrix.language != 'rust'
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
@@ -46,7 +46,7 @@ jobs:
 
       - name: Initialize CodeQL (Rust)
         if: matrix.language == 'rust'
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: none
@@ -57,6 +57,6 @@ jobs:
               - tests/semgrep/**
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index af7698a..c9cf932 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -93,7 +93,7 @@ jobs:
 
       - name: Obtain a short-lived crates.io token
         id: auth
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
 
       # Original main CI built default/exact packages without upload credentials.
       # Repackage the same clean, revalidated commit without running build scripts.
diff --git a/.github/workflows/release-benchmarks.yml b/.github/workflows/release-benchmarks.yml
index c2f6156..0a5f36a 100644
--- a/.github/workflows/release-benchmarks.yml
+++ b/.github/workflows/release-benchmarks.yml
@@ -35,7 +35,7 @@ jobs:
       validated-attempt: ${{ github.run_attempt }}
     steps:
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.13.6"
           enable-cache: false
@@ -177,7 +177,7 @@ jobs:
           persist-credentials: false
 
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.13.6"
           enable-cache: false
@@ -228,7 +228,7 @@ jobs:
 
     steps:
       - name: Install trusted package runner
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.13.6"
           enable-cache: false
diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml
index f56ce20..63b4c9d 100644
--- a/.github/workflows/rust-clippy.yml
+++ b/.github/workflows/rust-clippy.yml
@@ -58,7 +58,7 @@ jobs:
             github.event_name != 'pull_request'
             || github.event.pull_request.head.repo.full_name == github.repository
           )
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: rust-clippy-results.sarif
           category: "clippy"
diff --git a/.github/workflows/semgrep-sarif.yml b/.github/workflows/semgrep-sarif.yml
index 54f7f67..937d1db 100644
--- a/.github/workflows/semgrep-sarif.yml
+++ b/.github/workflows/semgrep-sarif.yml
@@ -70,7 +70,7 @@ jobs:
             github.event_name != 'pull_request' ||
             github.event.pull_request.head.repo.full_name == github.repository
           )
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: semgrep-results.sarif
           category: semgrep-repository-rules
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 63fbbda..75cbc36 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -54,7 +54,7 @@ jobs:
           !cancelled() && steps.sarif.outcome == 'success' &&
           (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
           github.actor != 'dependabot[bot]'
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: ${{ runner.temp }}/zizmor.sarif
           category: zizmor