diff --git a/.github/actions/build-wheels/action.yml b/.github/actions/build-wheels/action.yml
index b9e637d51..42d1cfa1b 100644
--- a/.github/actions/build-wheels/action.yml
+++ b/.github/actions/build-wheels/action.yml
@@ -75,7 +75,7 @@ runs:
         fi
         maturin build "${args[@]}"
     - name: Upload wheel artefact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: ${{ inputs.artifact-name }}
         path: ${{ inputs.wheelhouse }}/*.whl
diff --git a/.github/actions/pure-python-wheel/action.yml b/.github/actions/pure-python-wheel/action.yml
index a4797a4b7..1777e718a 100644
--- a/.github/actions/pure-python-wheel/action.yml
+++ b/.github/actions/pure-python-wheel/action.yml
@@ -26,7 +26,7 @@ runs:
       with:
         python-version: ${{ inputs.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
       with:
         enable-cache: false
     # Without --sdist or --wheel, uv builds the sdist first and then the wheel
@@ -39,7 +39,7 @@ runs:
         set -euo pipefail
         uv build --out-dir "${OUT_DIR}"
     - name: Upload sdist and wheel artefact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: ${{ inputs.artifact-name }}
         path: |
diff --git a/.github/actions/release-telemetry/action.yml b/.github/actions/release-telemetry/action.yml
index 852808cb3..eef201b6d 100644
--- a/.github/actions/release-telemetry/action.yml
+++ b/.github/actions/release-telemetry/action.yml
@@ -47,7 +47,7 @@ runs:
       id: upload
       if: ${{ !cancelled() && inputs.upload == 'true' }}
       continue-on-error: true
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: release-telemetry-${{ github.job }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/release-telemetry/records.jsonl
diff --git a/.github/workflows/benchmark-gate-harness.yml b/.github/workflows/benchmark-gate-harness.yml
index dcb3b5441..c98e1da41 100644
--- a/.github/workflows/benchmark-gate-harness.yml
+++ b/.github/workflows/benchmark-gate-harness.yml
@@ -35,7 +35,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       # Cached under the worktree-local directories the Makefile pins, which is
       # what makes the dependency sync here a few seconds rather than a minute.
diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index 3d24fa06e..e8cdd0a6e 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -146,7 +146,7 @@ jobs:
           maturin-version: ${{ env.MATURIN_VERSION }}
       - name: Upload wheel artefact (Linux)
         if: startsWith(matrix.os, 'ubuntu')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: wheels-native-${{ matrix.os }}-${{ matrix.arch }}
           path: wheelhouse/*.whl
@@ -198,7 +198,7 @@ jobs:
             3.14
             3.12
       - name: Download wheel artefacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           path: dist
       - name: Install pure Python wheel, then native wheel
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4bd0e619..fd7efd625 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -177,7 +177,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
 
       - name: Check the CV-005 contracts
         run: make test-workflow-contracts
@@ -625,7 +625,7 @@ jobs:
 
       - name: Install uv
         if: env.LEG_RUNS == 'true'
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
@@ -871,7 +871,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
@@ -1022,7 +1022,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: true
 
@@ -1217,7 +1217,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
@@ -1534,7 +1534,7 @@ jobs:
         id: gate-log-upload
         if: ${{ !cancelled() && env.ACT != 'true' && steps.gate-log.outputs.written == 'true' }}
         continue-on-error: true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: benchmark-gate-decision-${{ github.run_attempt }}
           path: ${{ runner.temp }}/benchmark-gate/decisions.jsonl
@@ -1619,7 +1619,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
@@ -1788,7 +1788,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
@@ -2097,7 +2097,7 @@ jobs:
 
       - name: Upload benchmark ratchet artefacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: benchmark-ratchet
           retention-days: 90
@@ -2182,7 +2182,7 @@ jobs:
           ${{ !cancelled() && github.event_name == 'push' &&
           github.ref == 'refs/heads/main' &&
           steps.candidate-artefacts.outputs.available == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: benchmark-ratchet-main-baseline
           if-no-files-found: error
diff --git a/.github/workflows/coverage-main.yml b/.github/workflows/coverage-main.yml
index f32bd47f2..a8e616def 100644
--- a/.github/workflows/coverage-main.yml
+++ b/.github/workflows/coverage-main.yml
@@ -176,7 +176,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/loom.yml b/.github/workflows/loom.yml
index 01f4ba97d..983460093 100644
--- a/.github/workflows/loom.yml
+++ b/.github/workflows/loom.yml
@@ -94,7 +94,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c17120b46..c2cda0a7a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -101,7 +101,7 @@ jobs:
           sparse-checkout: |
             scripts
             .github/actions/release-telemetry
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           pattern: wheels-*
           path: dist
@@ -133,7 +133,7 @@ jobs:
           mkdir -p dist/attestations
           bundle="cuprum-${GITHUB_REF_NAME}-run${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           cp "${BUNDLE_PATH}" "dist/attestations/${bundle}.sigstore.json"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         id: handoff
         with:
           name: release-dist
@@ -170,7 +170,7 @@ jobs:
       - *phase-clock
       - *scripts-checkout
       - &release-dist
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dist
           path: dist
@@ -202,7 +202,7 @@ jobs:
             gh release download "${GITHUB_REF_NAME}" --pattern "${name}" \
               --dir github-state/files
           done < github-state/carryover.txt
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         id: handoff
         with:
           name: release-github-state
@@ -237,7 +237,7 @@ jobs:
       - *phase-clock
       - *scripts-checkout
       - *release-dist
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-github-state
           path: github-state
diff --git a/.github/workflows/rust-boundaries.yml b/.github/workflows/rust-boundaries.yml
index 996f6f4de..07d54e87e 100644
--- a/.github/workflows/rust-boundaries.yml
+++ b/.github/workflows/rust-boundaries.yml
@@ -94,7 +94,7 @@ jobs:
         run: sccache --show-stats --stats-format json
       - name: Archive native evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: native-boundaries-${{ runner.os }}
           path: rust/target/boundary-verification
@@ -128,7 +128,7 @@ jobs:
             ~/.cargo/git
           key: ${{ env.CARGO_CACHE_KEY }}
           restore-keys: ${{ env.CARGO_CACHE_PREFIX }}
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           python-version: '3.13'
       - name: Restore pinned verifier, solver, and compiler objects
@@ -163,7 +163,7 @@ jobs:
         run: sccache --show-stats --stats-format json
       - name: Archive proof and negative compiler evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: verus-and-compiler-contracts
           path: rust/target/boundary-verification
@@ -207,7 +207,7 @@ jobs:
             ~/.cargo/git
           key: ${{ env.CARGO_CACHE_KEY }}
           restore-keys: ${{ env.CARGO_CACHE_PREFIX }}
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           python-version: '3.13'
       - name: Restore proof tools and Miri sysroots
@@ -247,7 +247,7 @@ jobs:
           make boundary-faults
       - name: Archive proof summaries and failures
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: extended-${{ matrix.check }}
           path: rust/target/boundary-verification