diff --git a/.github/workflows/dast.yml b/.github/workflows/dast.yml
index 6eda4b1..e0e8b3b 100644
--- a/.github/workflows/dast.yml
+++ b/.github/workflows/dast.yml
@@ -59,7 +59,7 @@ jobs:
     permissions:
       contents: read
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/reusable-zap.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/reusable-zap.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
     with:
       target: ${{ inputs.target }}
       fail-action: false
@@ -72,7 +72,7 @@ jobs:
       attestations: write
       contents: read
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
     with:
       subject-name: ${{ needs.subject.outputs.subject-name }}
       subject-digest: ${{ needs.subject.outputs.subject-digest }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 985dd39..110ae13 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -35,7 +35,7 @@ jobs:
   pin-check:
     permissions:
       contents: read
-    uses: attested-delivery/.github/.github/workflows/pin-check.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/pin-check.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
 
   build:
     needs: pin-check
@@ -49,7 +49,7 @@ jobs:
       artifact-digest: ${{ steps.digest.outputs.sha256 }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       # Enable pnpm via Node's built-in corepack rather than the third-party
@@ -146,7 +146,7 @@ jobs:
       attestations: write
       contents: read
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
     with:
       subject-name: artifact.tar
       subject-digest: sha256:${{ needs.build.outputs.artifact-digest }}
diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index cec6b56..93268b1 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -25,7 +25,7 @@ jobs:
     permissions:
       contents: read
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/pin-check.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/pin-check.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
 
   # SAST: this repo has CodeQL *default setup* enabled (org onboarding standard),
   # which provides SAST and uploads its own SARIF. An *advanced* CodeQL caller
@@ -41,7 +41,7 @@ jobs:
       security-events: write
       pull-requests: write
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
     with:
       fail-on-severity: high
 
@@ -53,7 +53,7 @@ jobs:
       contents: read
       actions: read
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/reusable-scorecard.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/reusable-scorecard.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
     with:
       publish-results: false
 
@@ -64,6 +64,6 @@ jobs:
       actions: read
       packages: read
     # attested-delivery/.github main @ 698148e (post-#4, 2026-06-19)
-    uses: attested-delivery/.github/.github/workflows/reusable-trivy.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
+    uses: attested-delivery/.github/.github/workflows/reusable-trivy.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
     with:
       scan-iac: true