diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index e1ca7ee7e..76de44873 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -95,7 +95,7 @@ jobs:
           # packages full releases only.
           [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::not a semver: $VERSION"; exit 1; }
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         if: steps.resolve.outputs.version != ''
         with:
           registry: ghcr.io
@@ -216,7 +216,7 @@ jobs:
       - name: Stage the verified binary
         run: cp "docker/dl/subshell-server-cli-${{ matrix.asset }}" "docker/bin/subshell-server-${{ matrix.arch }}"
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -235,7 +235,7 @@ jobs:
     needs: [plan, build]
     runs-on: ubuntu-24.04
     steps:
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # same pin as above
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # same pin as above
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -286,7 +286,7 @@ jobs:
     if: needs.plan.outputs.move_latest == 'true'
     runs-on: ubuntu-24.04
     steps:
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # same pin as above
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # same pin as above
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index f287474f1..66b08657d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -132,7 +132,7 @@ jobs:
       # test.yml pins node: a runner image floats its own node, and the
       # pinned version (the root package.json's `engines.node`) is the
       # contract, not the image's mood.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
@@ -167,7 +167,7 @@ jobs:
             fi
           done
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: docs-out
           path: apps/docs/out
@@ -197,7 +197,7 @@ jobs:
             apps/docs/wrangler.jsonc
           sparse-checkout-cone-mode: false
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: docs-out
           path: apps/docs/out
@@ -216,7 +216,7 @@ jobs:
         with:
           bun-version: 1.4.4
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d38eb7dd6..6f77431a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -180,7 +180,7 @@ jobs:
       # `npx changeset`, so pin a modern node for it (bun stays as-is below).
       # Version tracks the root package.json's `engines.node`, which is now
       # declared rather than inherited from whatever the host had.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
@@ -235,7 +235,7 @@ jobs:
       # versions are all published already: minutes spent to publish
       # nothing, which is the exact cost the split exists to avoid. Read
       # here, it answers about the commit that actually landed on main.
-      - uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
+      - uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
           # This job VERSIONS ONLY. Publishing to npm lives in `npm-publish`
           # below, because npm's OIDC trusted publishing supports hosted
@@ -308,7 +308,7 @@ jobs:
         with:
           bun-version: 1.4.4
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24   # trusted publishing needs npm >= 11.5.1, which node 24 carries
 
@@ -657,7 +657,7 @@ jobs:
       # image happens to ship, which is a lesson this repo learned on the
       # fleet (node 18 there) and which applies verbatim to hosted images.
       # Version tracks the root package.json's `engines.node`.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
@@ -1085,7 +1085,7 @@ jobs:
       # with "Artifact storage quota has been hit", which reads as a build
       # break and is not one. One day is generous for a same-run handoff and
       # makes the store self-limiting rather than something to purge by hand.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.app }}-${{ matrix.triple }}
           path: dist-rel/*
@@ -1123,7 +1123,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.plan.outputs.cli_apps) }}
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ matrix.app }}-*
           path: dist
@@ -1342,7 +1342,7 @@ jobs:
       # image happens to ship, which is a lesson this repo learned on the
       # fleet (node 18 there) and which applies verbatim to hosted images.
       # Version tracks the root package.json's `engines.node`.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
@@ -1770,7 +1770,7 @@ jobs:
       # with "Artifact storage quota has been hit", which reads as a build
       # break and is not one. One day is generous for a same-run handoff and
       # makes the store self-limiting rather than something to purge by hand.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.app }}-${{ matrix.triple }}
           path: dist-rel/*
@@ -1815,7 +1815,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.plan.outputs.desktop_apps) }}
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ matrix.app }}-*
           path: dist
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7bd0c4581..a3c14e813 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -134,7 +134,7 @@ jobs:
       - run: bun scripts/run-test-plan.ts integration
       - name: Upload browser failures
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report
           path: |
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 7ea2d9e46..269cf4ead 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -133,7 +133,7 @@ jobs:
       # test.yml pins node: a runner image floats its own node, and the
       # pinned version (the root package.json's `engines.node`) is the
       # contract, not the image's mood.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 
@@ -178,7 +178,7 @@ jobs:
             fi
           done
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: website-out
           path: apps/website/out
@@ -209,7 +209,7 @@ jobs:
             apps/website/wrangler.jsonc
           sparse-checkout-cone-mode: false
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: website-out
           path: apps/website/out
@@ -229,7 +229,7 @@ jobs:
         with:
           bun-version: 1.4.4
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24