diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c02c1f..11b3008 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
         steps:
             - uses: actions/checkout@v7
 
-            - uses: astral-sh/setup-uv@6a191366842ac1502ba6c07e9b5acd5c2d9d8db3 # 8.3.2
+            - uses: astral-sh/setup-uv@7211c7186911605100540c5bfaaf822f462c53d8 # 8.3.2
               with:
                   version: ${{ env.UV_VERSION }}
                   enable-cache: true
@@ -50,7 +50,7 @@ jobs:
         steps:
             - uses: actions/checkout@v7
 
-            - uses: astral-sh/setup-uv@6a191366842ac1502ba6c07e9b5acd5c2d9d8db3 # 8.3.2
+            - uses: astral-sh/setup-uv@7211c7186911605100540c5bfaaf822f462c53d8 # 8.3.2
               with:
                   version: ${{ env.UV_VERSION }}
                   python-version: ${{ matrix.python-version }}
@@ -103,7 +103,7 @@ jobs:
         steps:
             - uses: actions/checkout@v7
 
-            - uses: astral-sh/setup-uv@6a191366842ac1502ba6c07e9b5acd5c2d9d8db3 # 8.3.2
+            - uses: astral-sh/setup-uv@7211c7186911605100540c5bfaaf822f462c53d8 # 8.3.2
               with:
                   version: ${{ env.UV_VERSION }}
                   python-version: ${{ env.PYTHON_VERSION }}
@@ -158,7 +158,7 @@ jobs:
         steps:
             - uses: actions/checkout@v7
 
-            - uses: astral-sh/setup-uv@6a191366842ac1502ba6c07e9b5acd5c2d9d8db3 # 8.3.2
+            - uses: astral-sh/setup-uv@7211c7186911605100540c5bfaaf822f462c53d8 # 8.3.2
               with:
                   version: ${{ env.UV_VERSION }}
                   python-version: ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6eeed58..f8c1035 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
               with:
                   fetch-depth: 0
 
-            - uses: astral-sh/setup-uv@6a191366842ac1502ba6c07e9b5acd5c2d9d8db3 # 8.3.2
+            - uses: astral-sh/setup-uv@7211c7186911605100540c5bfaaf822f462c53d8 # 8.3.2
               with:
                   version: ${{ env.UV_VERSION }}
                   python-version: ${{ env.PYTHON_VERSION }}
@@ -110,10 +110,10 @@ jobs:
             - uses: actions/checkout@v7
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+              uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
             - name: Log in to GitHub Container Registry
-              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: ghcr.io
                   username: ${{ github.actor }}
@@ -143,7 +143,7 @@ jobs:
                   sbom: true
 
             - name: Attest candidate image
-              uses: actions/attest@v4.1.1
+              uses: actions/attest@v4.2.2
               with:
                   subject-name: ${{ env.IMAGE_REGISTRY }}/tsdhn-toolchain
                   subject-digest: ${{ steps.build.outputs.digest }}
@@ -179,10 +179,10 @@ jobs:
             - uses: actions/checkout@v7
 
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+              uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
             - name: Log in to GitHub Container Registry
-              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: ghcr.io
                   username: ${{ github.actor }}
@@ -214,7 +214,7 @@ jobs:
                   sbom: true
 
             - name: Attest candidate image
-              uses: actions/attest@v4.1.1
+              uses: actions/attest@v4.2.2
               with:
                   subject-name: ${{ env.IMAGE_REGISTRY }}/${{ matrix.image }}
                   subject-digest: ${{ steps.build.outputs.digest }}
@@ -248,7 +248,7 @@ jobs:
                   docker compose version
 
             - name: Log in to GitHub Container Registry
-              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: ghcr.io
                   username: ${{ github.actor }}
@@ -297,10 +297,10 @@ jobs:
             id-token: write
         steps:
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+              uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
             - name: Log in to GitHub Container Registry
-              uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+              uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
               with:
                   registry: ghcr.io
                   username: ${{ github.actor }}
@@ -354,7 +354,7 @@ jobs:
                   path: dist
 
             - name: Attest PyPI artifacts (SLSA build provenance)
-              uses: actions/attest@v4.1.1
+              uses: actions/attest@v4.2.2
               with:
                   subject-path: dist/**/*.tar.gz,dist/**/*.whl
                   show-summary: false
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 79e6f1a..18e3094 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,7 +21,7 @@ jobs:
               with:
                   fetch-depth: 0
 
-            - uses: ossf/scorecard-action@v2.4.3
+            - uses: ossf/scorecard-action@v2.4.4
               with:
                   results_file: results.sarif
                   results_format: sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ac41069..2c2970a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -49,7 +49,7 @@ jobs:
         steps:
             - uses: actions/checkout@v7
 
-            - uses: astral-sh/setup-uv@6a191366842ac1502ba6c07e9b5acd5c2d9d8db3 # 8.3.2
+            - uses: astral-sh/setup-uv@7211c7186911605100540c5bfaaf822f462c53d8 # 8.3.2
               with:
                   version: ${{ env.UV_VERSION }}
                   enable-cache: true