diff --git a/.github/workflows/acp-freshness.yml b/.github/workflows/acp-freshness.yml
index 0266fe6991..464165541c 100644
--- a/.github/workflows/acp-freshness.yml
+++ b/.github/workflows/acp-freshness.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install: false
           cache: false
diff --git a/.github/workflows/canary-container-images.yml b/.github/workflows/canary-container-images.yml
index b04bcc50aa..18efbafb56 100644
--- a/.github/workflows/canary-container-images.yml
+++ b/.github/workflows/canary-container-images.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install: false
           cache: false
@@ -50,7 +50,7 @@ jobs:
         run: mise run --skip-tools github-actions:resolve-image
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -61,7 +61,7 @@ jobs:
 
       - name: Build and push canary image
         id: build_image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ steps.service_config.outputs.context }}
           file: ${{ steps.service_config.outputs.dockerfile }}
diff --git a/.github/workflows/ci-adr.yml b/.github/workflows/ci-adr.yml
index 306d5a758e..72e97a4783 100644
--- a/.github/workflows/ci-adr.yml
+++ b/.github/workflows/ci-adr.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install: false
 
diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml
index 3f1ca6feae..03d3f0ef6d 100644
--- a/.github/workflows/ci-docs.yml
+++ b/.github/workflows/ci-docs.yml
@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           package_json_file: docs/package.json
 
diff --git a/.github/workflows/ci-go.yml b/.github/workflows/ci-go.yml
index ca26187fee..f7c7f6bd41 100644
--- a/.github/workflows/ci-go.yml
+++ b/.github/workflows/ci-go.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Go tooling via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: go buf rust cargo:wasm-tools
 
diff --git a/.github/workflows/ci-proto.yml b/.github/workflows/ci-proto.yml
index 46cade085a..470dc8fab5 100644
--- a/.github/workflows/ci-proto.yml
+++ b/.github/workflows/ci-proto.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: buf
 
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: buf
 
@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: buf
 
@@ -82,7 +82,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: buf
 
@@ -103,7 +103,7 @@ jobs:
           persist-credentials: false
 
       - name: Install proto codegen toolchain via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: buf rust cargo:protoc-gen-buffa cargo:protoc-gen-buffa-packaging
 
diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index cae333a3e5..7e96c1aed6 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -96,7 +96,7 @@ jobs:
           cache-workspace-crates: true
 
       - name: Install coverage tools
-        uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2.87.1
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
         with:
           tool: cargo-llvm-cov,nextest
 
diff --git a/.github/workflows/ci-semconv.yml b/.github/workflows/ci-semconv.yml
index bb13d4c2be..feb490bf33 100644
--- a/.github/workflows/ci-semconv.yml
+++ b/.github/workflows/ci-semconv.yml
@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Weaver via mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install_args: ubi:open-telemetry/weaver
 
diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index dc67b9ba94..a15ab51907 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           package_json_file: tsworkspace/package.json
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f0dff2bd09..fe3062e467 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,13 +39,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-and-quality
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml
index b699780174..d155d4f0b2 100644
--- a/.github/workflows/docs-pages.yml
+++ b/.github/workflows/docs-pages.yml
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           package_json_file: docs/package.json
 
@@ -66,4 +66,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index f6e1f63747..8958cbf547 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -39,7 +39,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           cache: false
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Install cross
         if: ${{ matrix.use-cross }}
-        uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2.87.1
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
         with:
           tool: cross
 
@@ -96,7 +96,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
         with:
           install: false
           cache: false