diff --git a/.github/workflows/bootstrap-qualification.yml b/.github/workflows/bootstrap-qualification.yml
index b5d79dc98..53960a29e 100644
--- a/.github/workflows/bootstrap-qualification.yml
+++ b/.github/workflows/bootstrap-qualification.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           python-version: "3.14.7"
       - name: Install exact uv payload
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           version: "0.12.4"
           enable-cache: false
@@ -98,7 +98,7 @@ jobs:
         with:
           python-version: "3.14.7"
       - name: Install exact uv payload
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           version: "0.12.4"
           enable-cache: false
diff --git a/.github/workflows/canonical-verification.yml b/.github/workflows/canonical-verification.yml
index 73afba6e6..8ff0763c5 100644
--- a/.github/workflows/canonical-verification.yml
+++ b/.github/workflows/canonical-verification.yml
@@ -68,7 +68,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -113,7 +113,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -157,7 +157,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -230,7 +230,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -287,7 +287,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -346,7 +346,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -411,7 +411,7 @@ jobs:
       - name: SonarCloud Scan
         id: scan
         continue-on-error: true
-        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8
         env:
           SONAR_TOKEN: ${{ secrets.sonar_token }}
       - name: Record quality-gate outcome
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a1cb0b5e..5353215eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,7 +76,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -107,7 +107,7 @@ jobs:
         with:
           python-version: ${{ matrix.python.payload }}
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -128,7 +128,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -159,7 +159,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -224,7 +224,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b1df33c9f..6a07915f1 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -37,7 +37,7 @@ jobs:
         with:
           python-version: "3.12.14"
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
diff --git a/.github/workflows/ground-control-phase-e.yml b/.github/workflows/ground-control-phase-e.yml
index c5d2a83cd..1397563f6 100644
--- a/.github/workflows/ground-control-phase-e.yml
+++ b/.github/workflows/ground-control-phase-e.yml
@@ -56,7 +56,7 @@ jobs:
       # The immutable merge revision, never the pull-request head. Phase E reads requirement
       # state from the merged tree and executes none of the delivered code; `fetch-depth: 0`
       # brings every branch, so the merge commit is present on the dispatch path too.
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha || github.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/python-free-threaded-preview.yml b/.github/workflows/python-free-threaded-preview.yml
index 24a09f864..06dbc1d15 100644
--- a/.github/workflows/python-free-threaded-preview.yml
+++ b/.github/workflows/python-free-threaded-preview.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           python-version: 3.14.7t
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index ea1584a6f..7863facdf 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -211,7 +211,7 @@ jobs:
           python-version: "3.12.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -272,7 +272,7 @@ jobs:
           python-version: "3.12.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
@@ -601,7 +601,7 @@ jobs:
           python-version: "3.12.14"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           enable-cache: false
           version: "0.12.4"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0b43c0953..14cf8f0d4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -53,6 +53,6 @@ jobs:
 
       - name: Upload Scorecard results to code scanning
         if: ${{ always() }}
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           sarif_file: results.sarif