diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 104d819..b17b783 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -57,4 +57,4 @@ jobs:
       contents: read
       id-token: write
     # SHA-pinned, per org policy — never a branch. The broker door pins this SHA too.
-    uses: bounded-systems/.github/.github/workflows/_auto-merge.yml@a0330aea1a9fc899ff1002bf52d20ef8d9b2edad
+    uses: bounded-systems/.github/.github/workflows/_auto-merge.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml
index 318a448..d5a73e8 100644
--- a/.github/workflows/claim-sweep.yml
+++ b/.github/workflows/claim-sweep.yml
@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@14c1a9b3ade8bb6416f46c890eda21823647da09
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index b34ad0a..69eecb0 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -43,4 +43,4 @@ jobs:
   osv:
     # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a
     # reviewer can tell an intentional bump from a drifted one.
-    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@30978ba6776c30081379e23fa20a12f36db3a48c # main
+    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@fb7ca62fd9fb8af90af1097a0b21ee703c103dc4 # main
diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml
index 4934806..a483bda 100644
--- a/.github/workflows/front-desk-add.yml
+++ b/.github/workflows/front-desk-add.yml
@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@99e88a0335519cb78be8a1b6623105613fa6aca1 # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 8d3e72b..3efd35a 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -136,7 +136,7 @@ jobs:
           ref: ${{ inputs.tag || github.ref_name }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml
index 871c69f..cebf7e0 100644
--- a/.github/workflows/pr-claim.yml
+++ b/.github/workflows/pr-claim.yml
@@ -81,4 +81,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@bc4cb7dada47cc59eed416372a4851201bd6f503
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 006868e..eb8176e 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -213,7 +213,7 @@ jobs:
           ref: ${{ inputs.ref }}
           path: .mint
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
 
diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml
index 7e716bf..b9f32b2 100644
--- a/.github/workflows/release-provenance.yml
+++ b/.github/workflows/release-provenance.yml
@@ -123,7 +123,7 @@ jobs:
           repository: bounded-systems/mint
           ref: ${{ inputs.ref }}
           path: .mint
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
       - name: Install mint deps
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0100bd7..8882c16 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -144,7 +144,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ needs.resolve.outputs.tag }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
       - run: npm ci --no-audit --no-fund
@@ -220,7 +220,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ needs.resolve.outputs.tag }}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           package-manager-cache: false
diff --git a/.github/workflows/standard.yml b/.github/workflows/standard.yml
index 67b0c3d..be258a6 100644
--- a/.github/workflows/standard.yml
+++ b/.github/workflows/standard.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   standard:
-    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@99e88a0335519cb78be8a1b6623105613fa6aca1
+    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
     with:
       security: true
       test: true
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 00b4da2..5c0bc5e 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -38,7 +38,7 @@ jobs:
           repository: bounded-systems/mint
           ref: ${{ inputs.ref }}
           path: .mint
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
       - name: Install mint deps