diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fcb74ac0..5c056946 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
         python-version: ['3.11', '3.12', '3.13', '3.14']   # the supported range (see requires-python)
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
 
       - name: Set up toolchain
         uses: ./.github/actions/setup
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6e5e91fd..f52c71a1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history + tags for hatch-vcs versioning)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
         with:
           fetch-depth: 0
 
@@ -42,7 +42,7 @@ jobs:
         run: python3 .github/scripts/check_changelog_release.py "${GITHUB_REF_NAME}"
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1   # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97   # v7.0.0
         with:
           python-version-file: .python-version
           check-latest: true
@@ -106,7 +106,7 @@ jobs:
       contents: read   # pure exit-code publish gate; no SARIF upload here (owned by security-sentinel)
     steps:
       - name: Checkout (full history for evil-merge detection)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
         with:
           fetch-depth: 0
       - name: Worm scan
@@ -140,7 +140,7 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b   # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33   # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           attestations: true
@@ -163,7 +163,7 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b   # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33   # v1.14.2
         with:
           attestations: true   # PEP 740 signed provenance, displayed on the PyPI page
           # A re-run of a tag whose files already published should no-op, not hard-fail.
@@ -179,7 +179,7 @@ jobs:
       contents: write          # create the release + upload assets
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
         with:
           fetch-depth: 0
       - name: Download distribution artifacts
@@ -222,16 +222,16 @@ jobs:
       packages: write          # push to GHCR via the built-in GITHUB_TOKEN — no extra secret
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
 
       - name: Derive version from tag (v0.1.0 -> 0.1.0)
         run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5   # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c   # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee   # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f   # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -239,7 +239,7 @@ jobs:
 
       - name: Image tags + OCI labels
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9   # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302   # v6.2.0
         with:
           images: ghcr.io/ndevu12/stayawakebot      # GHCR requires a lowercase path
           tags: |
@@ -252,7 +252,7 @@ jobs:
       # so a fixable critical/high never reaches GHCR (no "published-but-failed"). The push
       # step below reuses this build from the buildx cache.
       - name: Build image for scanning (load locally, no push yet)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf   # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a   # v7.3.0
         with:
           context: .
           build-args: VERSION=${{ env.VERSION }}
@@ -278,7 +278,7 @@ jobs:
           if-no-files-found: warn
 
       - name: Build & push (with SLSA provenance + SBOM attestations)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf   # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a   # v7.3.0
         with:
           context: .
           build-args: VERSION=${{ env.VERSION }}
diff --git a/.github/workflows/scanner-pin-drift.yml b/.github/workflows/scanner-pin-drift.yml
index b8e184bd..9b3e2357 100644
--- a/.github/workflows/scanner-pin-drift.yml
+++ b/.github/workflows/scanner-pin-drift.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history to diff against the pin)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/scanner-pin-freshness.yml b/.github/workflows/scanner-pin-freshness.yml
index 4801d9e1..f8be0f41 100644
--- a/.github/workflows/scanner-pin-freshness.yml
+++ b/.github/workflows/scanner-pin-freshness.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (for the decision script)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
       - name: Enforce a pin bump when the engine changes
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/security-remediate.yml b/.github/workflows/security-remediate.yml
index de652b40..eecda9a9 100644
--- a/.github/workflows/security-remediate.yml
+++ b/.github/workflows/security-remediate.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
       - name: Set up toolchain
         uses: ./.github/actions/setup
       - name: Open remediation PRs
diff --git a/.github/workflows/security-sentinel.yml b/.github/workflows/security-sentinel.yml
index 738e038a..9626ec14 100644
--- a/.github/workflows/security-sentinel.yml
+++ b/.github/workflows/security-sentinel.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for evil-merge detection)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
         with:
           fetch-depth: 0
 
@@ -66,7 +66,7 @@ jobs:
       # always(): the scan exits non-zero when infected, but the SARIF is written before that verdict.
       - name: Upload SARIF to code-scanning
         if: ${{ always() && vars.ENABLE_CODE_SCANNING == 'true' && hashFiles(format('{0}/latest.sarif', runner.temp)) != '' }}
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: ${{ runner.temp }}/latest.sarif
           category: saw-security-sentinel
diff --git a/.github/workflows/stayawake-sentinel.yml b/.github/workflows/stayawake-sentinel.yml
index 0469771e..4d32d744 100644
--- a/.github/workflows/stayawake-sentinel.yml
+++ b/.github/workflows/stayawake-sentinel.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
 
       - name: Set up toolchain
         uses: ./.github/actions/setup
diff --git a/.github/workflows/worm-guard.yml b/.github/workflows/worm-guard.yml
index 89aa1eb7..ff37b3d7 100644
--- a/.github/workflows/worm-guard.yml
+++ b/.github/workflows/worm-guard.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for evil-merge detection)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
         with:
           fetch-depth: 0
       - name: Scan for worm indicators