diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 8524f2a..e9b8870 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Upload reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: l9-audit-reports
           path: artifacts/
diff --git a/.github/workflows/baseline-ratchet-caller.yml b/.github/workflows/baseline-ratchet-caller.yml
index 6771038..946cad9 100644
--- a/.github/workflows/baseline-ratchet-caller.yml
+++ b/.github/workflows/baseline-ratchet-caller.yml
@@ -26,9 +26,9 @@ permissions:
 jobs:
   ratchet:
     name: Baseline Ratchet
-    uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@d81a06ed821106a487df2e5ad06d93e347392af6
+    uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@0d28395428426853c44825c4645c23ee8ace23b1
     with:
-      core-revision: d81a06ed821106a487df2e5ad06d93e347392af6
+      core-revision: 0d28395428426853c44825c4645c23ee8ace23b1
       sdk-revision: 0779fca8238011f8abea551895f96584676e9d17
       python-version: "3.12"
       pytest-paths: tests
diff --git a/.github/workflows/l9-analysis.yml b/.github/workflows/l9-analysis.yml
index d166bd5..65c65ca 100644
--- a/.github/workflows/l9-analysis.yml
+++ b/.github/workflows/l9-analysis.yml
@@ -95,7 +95,7 @@ jobs:
       - id: sdk
         name: Provision immutable SDK
         if: steps.gov.outputs.enabled == 'true'
-        uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1
+        uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@0d28395428426853c44825c4645c23ee8ace23b1
 
       - name: Normalize provider report
         if: steps.gov.outputs.enabled == 'true'
@@ -156,7 +156,7 @@ jobs:
 
       - name: Upload analysis artifact set
         if: steps.gov.outputs.enabled == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ steps.names.outputs.artifact-name }}
           path: |
@@ -170,7 +170,7 @@ jobs:
     name: Publish analysis (Core)
     needs: analyze
     if: needs.analyze.outputs.enabled == 'true'
-    uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1
+    uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@0d28395428426853c44825c4645c23ee8ace23b1
     permissions:
       actions: read
       checks: write
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index e3db0a4..1304b2a 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -76,7 +76,7 @@ jobs:
           sarif_file: scorecard.sarif
 
       - name: Upload Scorecard Results as Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: scorecard-results
           path: scorecard.sarif
@@ -122,7 +122,7 @@ jobs:
           fail-on-severity: high
           # dependency-review-action rejects specifying both allow-licenses and
           # deny-licenses. Keep the allow-list (stricter); deny-list is implied.
-          allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }}
+          allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause' }}
           comment-summary-in-pr: on-failure
 
 # ────────────────────────────────────────────────────────────────────────
@@ -217,7 +217,7 @@ jobs:
 
       - name: Upload License Report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: license-report
           path: |