diff --git a/.github/actions/setup-cosign/action.yml b/.github/actions/setup-cosign/action.yml
index 4b5291e..8e9cbae 100644
--- a/.github/actions/setup-cosign/action.yml
+++ b/.github/actions/setup-cosign/action.yml
@@ -3,10 +3,10 @@ description: Thin wrapper over sigstore/cosign-installer so the version is pinne
 
 inputs:
   cosign-version:
-    description: "cosign release (e.g. v3.1.1). Must be set: cosign-installer v4 rejects an empty release."
+    description: "cosign release (e.g. v3.1.3). Must be set: cosign-installer v4 rejects an empty release."
     required: false
     # renovate: datasource=github-releases depName=sigstore/cosign
-    default: "v3.1.1"
+    default: "v3.1.3"
 
 runs:
   using: composite
diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml
index 4cb536d..e79406e 100644
--- a/.github/actions/setup-go/action.yml
+++ b/.github/actions/setup-go/action.yml
@@ -14,7 +14,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ inputs.go-version }}
         cache-dependency-path: ${{ inputs.working-directory }}/go.sum
diff --git a/.github/actions/setup-mise/action.yml b/.github/actions/setup-mise/action.yml
index 506775c..d24cbfc 100644
--- a/.github/actions/setup-mise/action.yml
+++ b/.github/actions/setup-mise/action.yml
@@ -42,7 +42,7 @@ runs:
         fi
 
     - name: Cache mise tools
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.local/share/mise
         key: mise-${{ runner.os }}-${{ hashFiles('**/.mise.toml', '**/mise.toml', '**/.tool-versions') }}
diff --git a/.github/actions/setup-sops/action.yml b/.github/actions/setup-sops/action.yml
index 496a73a..6fe2319 100644
--- a/.github/actions/setup-sops/action.yml
+++ b/.github/actions/setup-sops/action.yml
@@ -6,12 +6,12 @@ inputs:
     description: "sops version (e.g. v3.9.1)"
     required: false
     # renovate: datasource=github-releases depName=getsops/sops
-    default: "v3.13.1"
+    default: "v3.13.3"
   age-version:
     description: "age version (e.g. v1.2.0)"
     required: false
     # renovate: datasource=github-releases depName=FiloSottile/age
-    default: "v1.3.1"
+    default: "v1.3.2"
   age-key:
     description: "age private key (multi-line). Written to ~/.config/sops/age/keys.txt"
     required: false
diff --git a/.github/actions/setup-trivy/action.yml b/.github/actions/setup-trivy/action.yml
index d8343a4..44a228b 100644
--- a/.github/actions/setup-trivy/action.yml
+++ b/.github/actions/setup-trivy/action.yml
@@ -6,7 +6,7 @@ inputs:
     description: "Trivy CLI version (without the 'v' prefix)"
     required: false
     # renovate: datasource=github-releases depName=aquasecurity/trivy
-    default: "0.71.0"
+    default: "0.74.0"
 
 runs:
   using: composite
diff --git a/.github/workflows/ansible.yml b/.github/workflows/ansible.yml
index abd2b3b..aed5319 100644
--- a/.github/workflows/ansible.yml
+++ b/.github/workflows/ansible.yml
@@ -52,7 +52,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Full path + floating major tag: a relative ./.github/actions path
       # inside a reusable resolves against the consumer's checkout, not this
@@ -67,7 +67,7 @@ jobs:
       # environments — no setup-python (which can't provision Python on newer
       # self-hosted runners), no global pip.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
diff --git a/.github/workflows/auto-revert-on-main-failure.yml b/.github/workflows/auto-revert-on-main-failure.yml
index 52e3d42..c1708c6 100644
--- a/.github/workflows/auto-revert-on-main-failure.yml
+++ b/.github/workflows/auto-revert-on-main-failure.yml
@@ -43,7 +43,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ inputs.default-branch }}
diff --git a/.github/workflows/bats.yml b/.github/workflows/bats.yml
index a3ab96d..aa4460d 100644
--- a/.github/workflows/bats.yml
+++ b/.github/workflows/bats.yml
@@ -52,7 +52,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install bats
         env:
@@ -91,7 +91,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install shellcheck
         run: |
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index d4e950f..d24fa31 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -67,7 +67,7 @@ jobs:
       issues: write
       id-token: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # claude-code-action self-validates that the workflow file
           # on the PR matches the version on the default branch
@@ -82,7 +82,7 @@ jobs:
         # anthropics/claude-code-action#1205) must never block a PR. The
         # review posts its findings as comments; the job status is not a gate.
         continue-on-error: true
-        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1.0.146
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: ${{ inputs.plugin-marketplace }}
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index ec81898..de61b42 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -57,12 +57,12 @@ jobs:
       id-token: write
       actions: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@0cb4f3e5e764d2e00407d29b6bf0aa9df0976d88 # v1.0.146
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1.0.210
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |
diff --git a/.github/workflows/compose-validate.yml b/.github/workflows/compose-validate.yml
index cc22639..9116a92 100644
--- a/.github/workflows/compose-validate.yml
+++ b/.github/workflows/compose-validate.yml
@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Export env vars
         if: inputs.env-vars != ''
diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml
index c2abb7b..d5b185e 100644
--- a/.github/workflows/container-security.yml
+++ b/.github/workflows/container-security.yml
@@ -75,7 +75,7 @@ jobs:
     outputs:
       images: ${{ steps.parse.outputs.images }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve image list
         id: parse
@@ -123,7 +123,7 @@ jobs:
       matrix:
         image: ${{ fromJson(needs.extract-images.outputs.images) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (table)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -153,7 +153,7 @@ jobs:
 
       - name: Upload SARIF
         if: always() && inputs.upload-sarif && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-${{ steps.safename.outputs.name }}.sarif
 
diff --git a/.github/workflows/dependabot-uv-lockfile.yml b/.github/workflows/dependabot-uv-lockfile.yml
index 41359b5..9e65763 100644
--- a/.github/workflows/dependabot-uv-lockfile.yml
+++ b/.github/workflows/dependabot-uv-lockfile.yml
@@ -48,14 +48,14 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Check out the PR branch (not the merge ref) so the push lands back
           # on it. fetch-depth 0 so the later push has the full ref.
           ref: ${{ github.head_ref }}
           fetch-depth: 0
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: ${{ inputs.uv-version }}
 
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 1e1b865..f4b9dc5 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -113,10 +113,10 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
       tags: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       # Mint a scoped App token for private modules pulled during the build.
       # setup-token (not setup-deps-reader) because we only need the token as
@@ -135,7 +135,7 @@ jobs:
 
       - name: Login to ${{ inputs.registry }}
         if: inputs.push
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ secrets.registry-username || github.actor }}
@@ -143,7 +143,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ inputs.registry }}/${{ inputs.image-name }}
           tags: |
@@ -156,7 +156,7 @@ jobs:
 
       - name: Build & push
         id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
@@ -218,13 +218,13 @@ jobs:
 
       - name: Upload SARIF
         if: inputs.run-trivy-scan && inputs.push && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy.sarif
 
       - name: Generate SBOM
         if: inputs.generate-sbom && inputs.push
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ inputs.registry }}/${{ inputs.image-name }}@${{ steps.build.outputs.digest }}
           format: spdx-json
diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml
index e3f9540..90153f6 100644
--- a/.github/workflows/elixir.yml
+++ b/.github/workflows/elixir.yml
@@ -187,7 +187,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Full path + floating major tag: a relative
       # ./.github/actions path inside a reusable resolves against the consumer's
@@ -210,14 +210,14 @@ jobs:
         with:
           working-directory: ${{ inputs.working-directory }}
 
-      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         if: ${{ !inputs.use-mise }}
         with:
           elixir-version: ${{ inputs.elixir-version }}
           otp-version: ${{ inputs.otp-version }}
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ inputs.working-directory }}/deps
@@ -381,7 +381,7 @@ jobs:
     env:
       MIX_ENV: ${{ inputs.mix-env }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure private-deps access
         if: inputs.deps-reader-client-id != ''
@@ -397,14 +397,14 @@ jobs:
         with:
           working-directory: ${{ inputs.working-directory }}
 
-      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         if: ${{ !inputs.use-mise }}
         with:
           elixir-version: ${{ inputs.elixir-version }}
           otp-version: ${{ inputs.otp-version }}
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ inputs.working-directory }}/deps
diff --git a/.github/workflows/expo.yml b/.github/workflows/expo.yml
index a91e2dd..3b891ef 100644
--- a/.github/workflows/expo.yml
+++ b/.github/workflows/expo.yml
@@ -92,7 +92,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve toolchain
         id: tc
@@ -138,7 +138,7 @@ jobs:
 
       - name: Setup Node
         if: ${{ !inputs.use-mise && inputs.package-manager != 'bun' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.package-manager }}
@@ -149,7 +149,7 @@ jobs:
       # manager's download dir explicitly (keyed on whichever lockfile exists).
       - name: Cache package downloads (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.tc.outputs.cache_path }}
           key: mise-${{ inputs.package-manager }}-${{ runner.os }}-${{ hashFiles('**/bun.lockb', '**/package-lock.json', '**/yarn.lock', '**/pnpm-lock.yaml') }}
diff --git a/.github/workflows/fastapi.yml b/.github/workflows/fastapi.yml
index 2a85429..76081cd 100644
--- a/.github/workflows/fastapi.yml
+++ b/.github/workflows/fastapi.yml
@@ -68,10 +68,10 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: ${{ inputs.working-directory }}/uv.lock
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 1b9d467..0934ec0 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -169,7 +169,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Referenced by full path + floating major
       # tag because a relative `./.github/actions/...` inside a reusable would
@@ -195,7 +195,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ !inputs.use-mise }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version }}
           cache-dependency-path: ${{ inputs.working-directory }}/go.sum
@@ -204,7 +204,7 @@ jobs:
       # such action, so cache them explicitly (keyed on go.sum).
       - name: Cache Go modules (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/go/pkg/mod
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index 6377c1a..9226e11 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install actionlint
         env:
@@ -62,7 +62,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Install yamllint via uv. actions/setup-python can't provision Python on
       # newer runners (e.g. Debian 13 self-hosted: "3.12 not found"); uv is
diff --git a/.github/workflows/molecule.yml b/.github/workflows/molecule.yml
index 21c684b..793374c 100644
--- a/.github/workflows/molecule.yml
+++ b/.github/workflows/molecule.yml
@@ -73,13 +73,13 @@ jobs:
       matrix:
         role: ${{ fromJson(needs.prepare-matrix.outputs.roles) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # uv provisions Python and runs molecule in an ephemeral uvx
       # environment — no setup-python (which can't provision Python on newer
       # self-hosted runners), no global pip.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
diff --git a/.github/workflows/node-bun.yml b/.github/workflows/node-bun.yml
index e66c829..995e3d7 100644
--- a/.github/workflows/node-bun.yml
+++ b/.github/workflows/node-bun.yml
@@ -86,7 +86,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve toolchain
         id: tc
@@ -134,7 +134,7 @@ jobs:
 
       - name: Setup Node
         if: ${{ !inputs.use-mise && inputs.package-manager != 'bun' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.package-manager }}
@@ -145,7 +145,7 @@ jobs:
       # manager's download dir explicitly (keyed on whichever lockfile exists).
       - name: Cache package downloads (mise path)
         if: inputs.use-mise
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.tc.outputs.cache_path }}
           key: mise-${{ inputs.package-manager }}-${{ runner.os }}-${{ hashFiles('**/bun.lockb', '**/package-lock.json', '**/yarn.lock', '**/pnpm-lock.yaml') }}
diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index df73e48..d806372 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -7,7 +7,7 @@ on:
         description: "OpenTofu version. Ignored when use-mise is true — the version then comes from the consumer's mise.toml."
         type: string
         # renovate: datasource=github-releases depName=opentofu/opentofu
-        default: "1.12.1"
+        default: "1.12.6"
       use-mise:
         description: |
           Install OpenTofu via mise (reads the consumer's mise.toml) instead
@@ -56,7 +56,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Full path + floating major tag: a relative ./.github/actions path
       # inside a reusable resolves against the consumer's checkout, not this
@@ -83,7 +83,7 @@ jobs:
           EOF
           fi
 
-      - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2.0.1
+      - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
         if: ${{ !inputs.use-mise }}
         with:
           tofu_version: ${{ inputs.tofu-version }}
diff --git a/.github/workflows/playwright-integration.yml b/.github/workflows/playwright-integration.yml
index 02eec9a..cd32f87 100644
--- a/.github/workflows/playwright-integration.yml
+++ b/.github/workflows/playwright-integration.yml
@@ -75,10 +75,10 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node (registry auth)
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
           # registry-url + scope only take effect (write an auth'd .npmrc)
diff --git a/.github/workflows/python-uv.yml b/.github/workflows/python-uv.yml
index a6c3b50..f133ab1 100644
--- a/.github/workflows/python-uv.yml
+++ b/.github/workflows/python-uv.yml
@@ -94,7 +94,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Private-deps access (opt-in). Referenced by full path + floating major
       # tag because a relative `./.github/actions/...` inside a reusable would
@@ -110,7 +110,7 @@ jobs:
           repositories: ${{ inputs.deps-reader-repositories }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: ${{ inputs.uv-version }}
           enable-cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f646b0..51134e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/scrapy.yml b/.github/workflows/scrapy.yml
index 75e2271..03812bb 100644
--- a/.github/workflows/scrapy.yml
+++ b/.github/workflows/scrapy.yml
@@ -57,10 +57,10 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           cache-dependency-glob: ${{ inputs.working-directory }}/uv.lock
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 4ddfe6b..5442ae1 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history is required for `betterleaks git` to traverse commits.
           fetch-depth: 0
diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
index 4d6dccd..961d903 100644
--- a/.github/workflows/self-test.yml
+++ b/.github/workflows/self-test.yml
@@ -23,8 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       - name: Validate composite action metadata
         run: |
           set -euo pipefail
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: setup-mise
         uses: ./.github/actions/setup-mise
diff --git a/.github/workflows/sops-audit.yml b/.github/workflows/sops-audit.yml
index 2a775c4..c05e028 100644
--- a/.github/workflows/sops-audit.yml
+++ b/.github/workflows/sops-audit.yml
@@ -47,7 +47,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # sops-config-changelog needs history to diff against base.
           fetch-depth: ${{ inputs.sops-config-changelog && 0 || 1 }}
diff --git a/.github/workflows/toml-lint.yml b/.github/workflows/toml-lint.yml
index 8f85821..3902c17 100644
--- a/.github/workflows/toml-lint.yml
+++ b/.github/workflows/toml-lint.yml
@@ -40,7 +40,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install taplo
         env:
@@ -63,12 +63,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # uv provisions the interpreter (setup-python can't on newer
       # self-hosted runners); tomllib is stdlib so nothing is pip-installed.
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Parse all TOML
         env:
diff --git a/.github/workflows/trivy-repo.yml b/.github/workflows/trivy-repo.yml
index 657ee45..6589739 100644
--- a/.github/workflows/trivy-repo.yml
+++ b/.github/workflows/trivy-repo.yml
@@ -98,7 +98,7 @@ jobs:
             *) echo "::error::invalid scan-type: $SCAN_TYPE (expected fs|config)"; exit 1 ;;
           esac
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (table)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -155,7 +155,7 @@ jobs:
             *) echo "::error::invalid scan-type: $SCAN_TYPE (expected fs|config)"; exit 1 ;;
           esac
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Trivy scan (SARIF)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -170,7 +170,7 @@ jobs:
           skip-files: ${{ inputs.skip-files }}
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-${{ inputs.scan-type }}.sarif
           # Distinguish fs vs config findings in the Security tab so they
diff --git a/.github/workflows/turbo.yml b/.github/workflows/turbo.yml
index a4e4553..a29d2e2 100644
--- a/.github/workflows/turbo.yml
+++ b/.github/workflows/turbo.yml
@@ -55,7 +55,7 @@ jobs:
     env:
       TURBO_TELEMETRY_DISABLED: 1
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: ${{ inputs.checkout-fetch-depth }}
 
@@ -72,7 +72,7 @@ jobs:
           bun-version-file: ${{ inputs.working-directory }}/package.json
 
       - name: Restore Turborepo cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ inputs.working-directory }}/.turbo
           # Suffix lets consumers segment caches per PR / per env without
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41cd7b8..a626a5a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,64 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
 
 ## [Unreleased]
 
+### Changed
+
+- Refreshed every pinned upstream action to its latest release. SHAs and the
+  trailing version comments both move; no input surface changes.
+
+  | Action | Was | Now |
+  | --- | --- | --- |
+  | `astral-sh/setup-uv` | v8.2.0 | v10.0.1 |
+  | `actions/checkout` | v6.0.3 | v7.0.1 |
+  | `actions/cache` | v5.0.5 | v6.1.0 |
+  | `actions/setup-node` | v6.4.0 | v7.0.0 |
+  | `actions/setup-go` | v6.4.0 | v7.0.0 |
+  | `github/codeql-action/upload-sarif` | v4.36.2 | v4.37.9 |
+  | `anthropics/claude-code-action` | v1.0.146 | v1.0.210 |
+  | `docker/login-action` | v4.2.0 | v4.6.0 |
+  | `docker/setup-buildx-action` | v4.1.0 | v4.3.0 |
+  | `docker/setup-qemu-action` | v4.1.0 | v4.2.0 |
+  | `docker/metadata-action` | v6.1.0 | v6.2.0 |
+  | `docker/build-push-action` | v7.2.0 | v7.3.0 |
+  | `erlef/setup-beam` | v1.24.0 | v1.24.1 |
+  | `anchore/sbom-action` | v0.24.0 | v0.24.2 |
+  | `opentofu/setup-opentofu` | v2.0.1 | v2.0.2 |
+
+  The `actions/*` majors are ESM/dependency migrations with no input changes;
+  all were already `node24`, so they need no newer runner agent than the
+  pinned versions did. `actions/checkout` v7 additionally refuses to check out
+  a fork PR head under `pull_request_target` / `workflow_run` — no workflow
+  here does that (the only `ref:` uses are `inputs.default-branch` and
+  `github.head_ref`), but consumers that check out a fork head from those
+  events will need `actions/checkout@v6` or a redesign.
+
+  `setup-uv` crosses two breaking releases: v9 flips `prune-cache` to `false`
+  (larger caches, evicted by GitHub's per-repo LRU — no billing impact), and
+  v10 disables caching under `pull_request_target` / `workflow_run` /
+  `release` when `enable-cache` is left at `auto`. Every caching call site
+  here sets `enable-cache: true` explicitly, so v10's default change is inert
+  for them.
+
+- Bumped the pinned tool-version input defaults to current releases; each
+  download URL was preflighted against the upstream release assets.
+
+  | Input | Was | Now |
+  | --- | --- | --- |
+  | `setup-trivy` `trivy-version` | 0.71.0 | 0.74.0 |
+  | `setup-cosign` `cosign-version` | v3.1.1 | v3.1.3 |
+  | `setup-sops` `sops-version` | v3.13.1 | v3.13.3 |
+  | `setup-sops` `age-version` | v1.3.1 | v1.3.2 |
+  | `opentofu.yml` `tofu-version` | 1.12.1 | 1.12.6 |
+
+  Already current: `taplo` 0.10.0, `betterleaks` 1.8.1, `actionlint` 1.7.12,
+  `trivy-action-version` 0.36.0.
+
+### Documentation
+
+- Example snippets in `README.md` / `examples/README.md` now show
+  `actions/checkout@v7`, `astral-sh/setup-uv@v10` and `actions/labeler@v7`
+  (the labeler config format is unchanged from v5).
+
 ## [3.0.1] - 2026-08-30
 
 ### Fixed
diff --git a/README.md b/README.md
index 3b12f25..d892de9 100644
--- a/README.md
+++ b/README.md
@@ -122,7 +122,7 @@ which default to the self-hosted pool.
 
 ```yaml
 steps:
-  - uses: actions/checkout@v6
+  - uses: actions/checkout@v7
   - uses: nkg/github-actions/.github/actions/setup-mise@v3
   - run: mise run build
 ```
diff --git a/examples/README.md b/examples/README.md
index 0ec2ebb..43abb28 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -762,7 +762,7 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v7
 ```
 
 `.github/labeler.yml` (the per-repo config the action consumes):
@@ -817,7 +817,7 @@ jobs:
       web: ${{ steps.f.outputs.web }}
       api: ${{ steps.f.outputs.api }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - id: f
         uses: dorny/paths-filter@v4
         with:
@@ -902,7 +902,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-sops@v3
         with:
           age-key: ${{ secrets.SOPS_AGE_KEY }}
@@ -920,13 +920,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-deps-reader@v3
         with:
           app-client-id: ${{ vars.DEPS_READER_CLIENT_ID }}
           app-private-key: ${{ secrets.DEPS_READER_PRIVATE_KEY }}
           repositories: sproncy-schemas,sproncy-secrets-core
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@v10
       - run: uv sync --frozen
 ```
 
@@ -937,7 +937,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-trivy@v3
       - run: trivy fs --severity HIGH,CRITICAL .
 
@@ -958,7 +958,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-mise@v3   # runs `mise install` from .mise.toml
       - run: mise run build
 ```
@@ -970,7 +970,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: nkg/github-actions/.github/actions/setup-go@v3
         with:
           go-version: "1.23"
@@ -994,7 +994,7 @@ jobs:
           app-client-id: ${{ vars.APP_CLIENT_ID }}
           app-private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write          # omit all permission-* for the installation's full set
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ steps.token.outputs.token }}
       - run: git push