diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 8524f2a..75e0f91 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Upload reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: l9-audit-reports
           path: artifacts/
diff --git a/.github/workflows/baseline-ratchet-caller.yml b/.github/workflows/baseline-ratchet-caller.yml
index 6771038..3e0bdf3 100644
--- a/.github/workflows/baseline-ratchet-caller.yml
+++ b/.github/workflows/baseline-ratchet-caller.yml
@@ -26,10 +26,10 @@ permissions:
 jobs:
   ratchet:
     name: Baseline Ratchet
-    uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@d81a06ed821106a487df2e5ad06d93e347392af6
+    uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@0d28395428426853c44825c4645c23ee8ace23b1
     with:
-      core-revision: d81a06ed821106a487df2e5ad06d93e347392af6
-      sdk-revision: 0779fca8238011f8abea551895f96584676e9d17
+      core-revision: 0d28395428426853c44825c4645c23ee8ace23b1
+      sdk-revision: b1a491414ed04bb18d665f8a8755de80947c8200
       python-version: "3.12"
       pytest-paths: tests
       test-quarantine-ledger: .l9/baselines/test-quarantine.yml
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index b3ed6b3..4222974 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -140,7 +140,7 @@ jobs:
 
       - name: Attest Build Provenance
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/l9-analysis.yml b/.github/workflows/l9-analysis.yml
index d166bd5..65c65ca 100644
--- a/.github/workflows/l9-analysis.yml
+++ b/.github/workflows/l9-analysis.yml
@@ -95,7 +95,7 @@ jobs:
       - id: sdk
         name: Provision immutable SDK
         if: steps.gov.outputs.enabled == 'true'
-        uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1
+        uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@0d28395428426853c44825c4645c23ee8ace23b1
 
       - name: Normalize provider report
         if: steps.gov.outputs.enabled == 'true'
@@ -156,7 +156,7 @@ jobs:
 
       - name: Upload analysis artifact set
         if: steps.gov.outputs.enabled == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ steps.names.outputs.artifact-name }}
           path: |
@@ -170,7 +170,7 @@ jobs:
     name: Publish analysis (Core)
     needs: analyze
     if: needs.analyze.outputs.enabled == 'true'
-    uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1
+    uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@0d28395428426853c44825c4645c23ee8ace23b1
     permissions:
       actions: read
       checks: write
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index e3db0a4..2725143 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -76,7 +76,7 @@ jobs:
           sarif_file: scorecard.sarif
 
       - name: Upload Scorecard Results as Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scorecard-results
           path: scorecard.sarif
@@ -122,7 +122,10 @@ jobs:
           fail-on-severity: high
           # dependency-review-action rejects specifying both allow-licenses and
           # deny-licenses. Keep the allow-list (stricter); deny-list is implied.
+          # SPDX AND compounds in allow-licenses do not match package Dual
+          # licenses and also break MIT matching (upload-artifact 7.0.1).
           allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }}
+          allow-dependencies-licenses: pkg:pypi/structlog, pkg:pypi/prometheus-client
           comment-summary-in-pr: on-failure
 
 # ────────────────────────────────────────────────────────────────────────
@@ -217,7 +220,7 @@ jobs:
 
       - name: Upload License Report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: license-report
           path: |
diff --git a/poetry.lock b/poetry.lock
index 90b51ea..df21d7b 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.3.2 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand.
 
 [[package]]
 name = "annotated-doc"
@@ -1398,14 +1398,14 @@ testing = ["coverage", "pytest", "pytest-benchmark"]
 
 [[package]]
 name = "prometheus-client"
-version = "0.24.1"
+version = "0.26.0"
 description = "Python client for the Prometheus monitoring system."
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "prometheus_client-0.24.1-py3-none-any.whl", hash = "sha256:150db128af71a5c2482b36e588fc8a6b95e498750da4b17065947c16070f4055"},
-    {file = "prometheus_client-0.24.1.tar.gz", hash = "sha256:7e0ced7fbbd40f7b84962d5d2ab6f17ef88a72504dcf7c0b40737b43b2a461f9"},
+    {file = "prometheus_client-0.26.0-py3-none-any.whl", hash = "sha256:fa93d06737aa02bacd05794768508bb97d2fbee28cb3bca04eaae92f0ca953d6"},
+    {file = "prometheus_client-0.26.0.tar.gz", hash = "sha256:04a91bcf94e2cf74a44a1a874d651a2e853ed354b6e822f3b7487751465d5c2b"},
 ]
 
 [package.extras]
@@ -1985,14 +1985,14 @@ full = ["httpx (>=0.27.0,<0.29.0)", "httpx2 (>=2.0.0)", "itsdangerous", "jinja2"
 
 [[package]]
 name = "structlog"
-version = "25.5.0"
+version = "26.1.0"
 description = "Structured Logging for Python"
 optional = false
-python-versions = ">=3.8"
+python-versions = ">=3.10"
 groups = ["main"]
 files = [
-    {file = "structlog-25.5.0-py3-none-any.whl", hash = "sha256:a8453e9b9e636ec59bd9e79bbd4a72f025981b3ba0f5837aebf48f02f37a7f9f"},
-    {file = "structlog-25.5.0.tar.gz", hash = "sha256:098522a3bebed9153d4570c6d0288abf80a031dfdb2048d59a49e9dc2190fc98"},
+    {file = "structlog-26.1.0-py3-none-any.whl", hash = "sha256:e081a26d6c373e6d201eca24eede26d8ffab07f88f477822e679183428d3d91e"},
+    {file = "structlog-26.1.0.tar.gz", hash = "sha256:f63a716cbd1b1291cf7661de7794b455acfa4c43c5bcf1630e6ad5ddc1adb3b7"},
 ]
 
 [[package]]
@@ -2549,4 +2549,4 @@ dev = ["pytest", "setuptools"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.12"
-content-hash = "c13b08e33b20faf4025e3426314fa99d2072248154240eff2e3f90e430b47c2d"
+content-hash = "a556f6b155b8192463ecadd9016fbd3e96c90e0e436f80b4ffb6fa67c71f0035"
diff --git a/pyproject.toml b/pyproject.toml
index bedb4c4..927bf5c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,8 +19,8 @@ python-multipart = ">=0.0.9,<0.0.32"
 redis = "^7.4.0"
 apscheduler = "^3.10.0"
 httpx = "^0.28.0"
-structlog = "^25.5.0"
-prometheus-client = "^0.24.1"
+structlog = ">=25.5,<27.0"
+prometheus-client = ">=0.24.1,<0.27.0"
 numpy = "^2.4.3"
 openai = "^1.0.0"
 asyncpg = "^0.31.0"
diff --git a/requirements.txt b/requirements.txt
index c37526a..c648baf 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -13,7 +13,7 @@ python-multipart>=0.0.9,<1.0.0
 redis>=7.4.0,<8.0.0
 apscheduler>=3.10.0,<4.0.0
 httpx>=0.28.0,<0.29.0
-structlog>=25.5.0,<26.0.0
+structlog>=25.5.0,<27.0.0
 prometheus-client>=0.24.1,<1.0.0
 numpy>=2.4.3,<3.0.0
 openai>=1.0.0,<2.0.0