diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index 6f63da6..a356731 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -22,13 +22,13 @@ jobs:
     outputs:
       docs_only: ${{ steps.docs.outputs.docs_only }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.sha }}
           path: .docs-gate
           persist-credentials: false
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         if: github.event_name == 'pull_request_target'
         with:
           fetch-depth: 0
@@ -36,7 +36,7 @@ jobs:
           path: .candidate
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: "22"
 
@@ -58,7 +58,7 @@ jobs:
 
       - name: Retain docs-only diff proof
         if: steps.docs.outputs.docs_only == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: codegen-docs-diff
           path: ${{ runner.temp }}/codegen-docs-diff.json
@@ -73,14 +73,14 @@ jobs:
     env:
       PYTHONHASHSEED: "0"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: "3.14"
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: "22"
       - name: Install codegen and node dependencies
@@ -95,7 +95,7 @@ jobs:
         run: npm run gate:full
       - name: Upload release.json
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: release-json
           path: release.json
@@ -115,12 +115,12 @@ jobs:
     env:
       PYTHONHASHSEED: "0"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install with dev extras
diff --git a/.github/workflows/promote-baseline.yml b/.github/workflows/promote-baseline.yml
index 684e486..fa3226b 100644
--- a/.github/workflows/promote-baseline.yml
+++ b/.github/workflows/promote-baseline.yml
@@ -118,7 +118,7 @@ jobs:
           esac
 
       # The base branch, never the PR (pull_request_target checks out main).
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -208,7 +208,7 @@ jobs:
       - name: Mint an org App token to read the campaign tooling
         id: app
         if: steps.ci.outputs.green == 'true'
-        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         with:
           app-id: ${{ secrets.PINEFORGE_APP_ID }}
           private-key: ${{ secrets.PINEFORGE_APP_PRIVATE_KEY }}
@@ -218,7 +218,7 @@ jobs:
 
       - name: Checkout campaign tooling (pineforge-workflow)
         if: steps.ci.outputs.green == 'true'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ vars.WORKFLOW_REPO || 'pineforge-4pass/pineforge-workflow' }}
           ref: ${{ vars.WORKFLOW_REF || 'main' }}
@@ -226,21 +226,21 @@ jobs:
           path: .workflow
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.ci.outputs.green == 'true'
         with:
           node-version: '22'
 
       - name: Authenticate to GCP
         if: steps.ci.outputs.green == 'true'
-        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
           workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
 
       - name: Set up gcloud
         if: steps.ci.outputs.green == 'true'
-        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
 
       # The plane is Postgres on Cloud SQL; the promotion reads the active
       # baseline and the gate ledger there, so this runner needs the same
diff --git a/.github/workflows/publish-pyodide.yml b/.github/workflows/publish-pyodide.yml
index 7c2b2f5..9638a50 100644
--- a/.github/workflows/publish-pyodide.yml
+++ b/.github/workflows/publish-pyodide.yml
@@ -29,7 +29,7 @@ jobs:
     env:
       PYTHONHASHSEED: "0"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       # Tag push must match VERSION (mirrors mcp). Skipped for dispatch.
       - name: Verify tag matches VERSION
@@ -50,11 +50,11 @@ jobs:
           set -euo pipefail
           python3 scripts/release_version.py channels "$(tr -d '[:space:]' < VERSION)" | tee -a "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14"
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "22"
           registry-url: https://registry.npmjs.org
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d8339b9..4d6741d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,14 +49,14 @@ jobs:
       # the hub. Minted first so checkout can push with it.
       - name: Mint org App token
         id: app
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.PINEFORGE_APP_ID }}
           private-key: ${{ secrets.PINEFORGE_APP_PRIVATE_KEY }}
           owner: pineforge-4pass
           repositories: pineforge-codegen-oss,pineforge-release
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           fetch-depth: 0
           # App token bypasses the main ruleset for the release commit/tag push.
@@ -80,11 +80,11 @@ jobs:
       - name: Show diff
         run: git --no-pager diff
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14"   # match the gate's runtime
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d5e8daa..a098c1e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
     outputs:
       docs_only: ${{ steps.docs.outputs.docs_only }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           ref: ${{ github.sha }}
@@ -43,7 +43,7 @@ jobs:
 
       - name: Read the base branch's trusted docs rule
         if: steps.base.outputs.sha != ''
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ steps.base.outputs.sha }}
           path: .docs-gate
@@ -75,12 +75,12 @@ jobs:
     env:
       PYTHONHASHSEED: "0"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install with dev extras