diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index f3ed92f..c646c74 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -118,7 +118,7 @@ jobs:
           persist-credentials: false
 
       - name: Upload the fixture build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: build-fixture
           path: tests/fixtures/build-fixture
diff --git a/.github/workflows/reusable-block-json-check.yml b/.github/workflows/reusable-block-json-check.yml
index 7e865f6..551b431 100644
--- a/.github/workflows/reusable-block-json-check.yml
+++ b/.github/workflows/reusable-block-json-check.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
 
diff --git a/.github/workflows/reusable-codeql.yml b/.github/workflows/reusable-codeql.yml
index aadefab..8279319 100644
--- a/.github/workflows/reusable-codeql.yml
+++ b/.github/workflows/reusable-codeql.yml
@@ -47,10 +47,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
 
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/reusable-php-syntax-check.yml b/.github/workflows/reusable-php-syntax-check.yml
index 82b5b8e..f6e08d0 100644
--- a/.github/workflows/reusable-php-syntax-check.yml
+++ b/.github/workflows/reusable-php-syntax-check.yml
@@ -72,7 +72,7 @@ jobs:
 
       - name: Download the build
         if: inputs.artifact != ''
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.artifact }}
 
diff --git a/.github/workflows/reusable-phpunit.yml b/.github/workflows/reusable-phpunit.yml
index 9204608..bc6df54 100644
--- a/.github/workflows/reusable-phpunit.yml
+++ b/.github/workflows/reusable-phpunit.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Setup Node.js (for wp-env)
         if: ${{ inputs.needs-wp-env }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.project-path }}/package.json
           cache: 'npm'
diff --git a/.github/workflows/reusable-playwright-e2e.yml b/.github/workflows/reusable-playwright-e2e.yml
index 4610bd8..e0c388d 100644
--- a/.github/workflows/reusable-playwright-e2e.yml
+++ b/.github/workflows/reusable-playwright-e2e.yml
@@ -83,7 +83,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.project-path }}/package.json
           cache: 'npm'
@@ -145,7 +145,7 @@ jobs:
 
       - name: Upload Playwright report on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-report-${{ inputs.artifact-slug }}
           path: |
diff --git a/.github/workflows/reusable-plugin-check.yml b/.github/workflows/reusable-plugin-check.yml
index fab60bd..3ed17b2 100644
--- a/.github/workflows/reusable-plugin-check.yml
+++ b/.github/workflows/reusable-plugin-check.yml
@@ -65,7 +65,7 @@ jobs:
           echo "checks=$checks" >> "$GITHUB_OUTPUT"
 
       - name: Download the build
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.artifact }}
           path: plugin-check-build/${{ inputs.plugin-slug }}
diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml
index 4bfe0e8..ba4f5a3 100644
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -236,7 +236,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.project-path }}/package.json
           package-manager-cache: false
@@ -501,7 +501,7 @@ jobs:
           repo-token: ''
 
       - name: Upload zip artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.plugin-slug }}-zip
           path: ${{ inputs.project-path }}/${{ inputs.plugin-slug }}.zip
@@ -520,7 +520,7 @@ jobs:
 
       - name: Upload wp.org assets artifact
         if: ${{ inputs.wp-org }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.plugin-slug }}-wp-org-assets
           path: ${{ inputs.project-path }}/wp-org-assets-artifact/**
@@ -544,7 +544,7 @@ jobs:
           persist-credentials: false
 
       - name: Download built artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.plugin-slug }}-zip
           path: ./dist
@@ -579,7 +579,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.project-path }}/package.json
           package-manager-cache: false
@@ -726,7 +726,7 @@ jobs:
           persist-credentials: false
 
       - name: Download built artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.plugin-slug }}-zip
           path: ./dist
@@ -777,13 +777,13 @@ jobs:
       PLUGIN_SLUG: ${{ inputs.plugin-slug }}
     steps:
       - name: Download built artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.plugin-slug }}-zip
           path: ./dist
 
       - name: Download wp.org assets artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.plugin-slug }}-wp-org-assets
           path: ./wp-org-assets
diff --git a/.github/workflows/reusable-scripts-styles-lint.yml b/.github/workflows/reusable-scripts-styles-lint.yml
index 4bbb3ed..6dd80eb 100644
--- a/.github/workflows/reusable-scripts-styles-lint.yml
+++ b/.github/workflows/reusable-scripts-styles-lint.yml
@@ -58,7 +58,7 @@ jobs:
           fi
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.project-path }}/package.json
           cache: 'npm'
diff --git a/.github/workflows/reusable-supply-chain-audit.yml b/.github/workflows/reusable-supply-chain-audit.yml
index 1f7f9df..4a31d52 100644
--- a/.github/workflows/reusable-supply-chain-audit.yml
+++ b/.github/workflows/reusable-supply-chain-audit.yml
@@ -131,7 +131,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '26'
       - name: npm audit
diff --git a/.github/workflows/reusable-workflow-checks.yml b/.github/workflows/reusable-workflow-checks.yml
index 9f86c5b..f725c92 100644
--- a/.github/workflows/reusable-workflow-checks.yml
+++ b/.github/workflows/reusable-workflow-checks.yml
@@ -93,14 +93,14 @@ jobs:
       - name: Run zizmor
         id: zizmor
         if: needs.detect-ghas.outputs.ghas-available == 'true'
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           version: ${{ env.ZIZMOR_VERSION }}
 
       # Without Advanced Security, zizmor runs in plain mode, where its own nonzero exit on a finding fails the job.
       - name: Run zizmor without Advanced Security
         if: needs.detect-ghas.outputs.ghas-available == 'false'
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           version: ${{ env.ZIZMOR_VERSION }}
           advanced-security: false