diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 4c0c7954f..8b38d964d 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -25,15 +25,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
       # v4.1.0
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v4
         with:
           node-version: '22'
           corepack: true
           cache: 'pnpm'
-      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76  # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: ${{ env.BUN_VERSION }}
       # cache-provider stays "github": this job mounts no cache of its own, so
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0a6c19928..c2e092b38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,13 +73,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           persist-credentials: false
           fetch-depth: 0
 
       # v4.1.0
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
       # `cache: 'pnpm'` makes this action the sole owner of the pnpm store.
       # No other step in this job touches it.
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v4
@@ -87,7 +87,7 @@ jobs:
           node-version: '22'
           corepack: true
           cache: 'pnpm'
-      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76  # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: ${{ env.BUN_VERSION }}
 
@@ -320,7 +320,7 @@ jobs:
         run: make nixie
 
       - name: Markdown lint
-        uses: DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25  # v24.0.0
+        uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff  # v24.2.0
         with:
           globs: '**/*.md'
 
@@ -696,7 +696,7 @@ jobs:
       # 60 minutes — so raise the cap well above it.
       RUN_RUST_CARGO_WAIT_TIMEOUT: '5400'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/coverage-main.yml b/.github/workflows/coverage-main.yml
index 5f15a961f..4931f1074 100644
--- a/.github/workflows/coverage-main.yml
+++ b/.github/workflows/coverage-main.yml
@@ -51,7 +51,7 @@ jobs:
       # wall-clock cap above the repo's 60-minute nextest global-timeout.
       RUN_RUST_CARGO_WAIT_TIMEOUT: '5400'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
 
       - name: Set cache keys