diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cef20936..7143032b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -258,7 +258,7 @@ jobs:
       - name: Upload unit junit and durations
         timeout-minutes: 2
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: unit-reports-${{ github.sha }}
           path: ${{ runner.temp }}/unit-reports/
@@ -627,7 +627,7 @@ jobs:
       - name: Upload compatibility result
         timeout-minutes: 2
         if: always() && (matrix.candidate == false || inputs.service_template_candidate_ref != '')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: template-compat-${{ matrix.entry }}
           path: |
@@ -848,7 +848,7 @@ jobs:
       - name: Preserve runner proof evidence
         if: always()
         timeout-minutes: 2
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: runner-proof-${{ matrix.leg }}-${{ env.ORCHESTRATOR_SHA }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/runner-proof
@@ -896,7 +896,7 @@ jobs:
         timeout-minutes: 2
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 22.23.2
           cache: npm
@@ -1253,7 +1253,7 @@ jobs:
           DIGEST_FILE: ${{ runner.temp }}/worker-images.json
 
       - name: Upload published worker image digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: worker-images-${{ github.sha }}
           path: ${{ runner.temp }}/worker-images.json
@@ -1312,7 +1312,7 @@ jobs:
           DIGEST_FILE: ${{ runner.temp }}/service-images.json
 
       - name: Upload published service image digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: service-images-${{ github.sha }}
           path: ${{ runner.temp }}/service-images.json
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c2383c8ac..3e12cb97f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -636,14 +636,14 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload deployed worker image digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: deployed-worker-images-${{ env.DEPLOY_REVISION }}
           path: ${{ runner.temp }}/deployed-worker-images.json
           if-no-files-found: error
 
       - name: Upload deployed service image digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: deployed-service-images-${{ env.DEPLOY_REVISION }}
           path: ${{ runner.temp }}/deployed-service-images.json
diff --git a/.github/workflows/stand-e2e.yml b/.github/workflows/stand-e2e.yml
index 9faa5c6b2..216357304 100644
--- a/.github/workflows/stand-e2e.yml
+++ b/.github/workflows/stand-e2e.yml
@@ -135,7 +135,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       # The suite is a named one or a pytest target; `custom` is how the second
       # kind is spelled in a dropdown, and it has to name a target.
@@ -1355,7 +1355,7 @@ jobs:
 
       - name: Upload cleanup handoff
         if: ${{ always() && steps.handoff-admission.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: stand-e2e-handoff-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/stand-e2e-handoff
@@ -1385,7 +1385,7 @@ jobs:
         id: handoff
         if: always()
         continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: stand-e2e-handoff-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/stand-e2e-handoff
@@ -1495,7 +1495,7 @@ jobs:
 
       - name: Upload acceptance artifact
         if: ${{ always() && steps.final-admission.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: stand-e2e-acceptance-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/stand-acceptance
diff --git a/.github/workflows/template-fixture.yml b/.github/workflows/template-fixture.yml
index 60e62a874..67696f604 100644
--- a/.github/workflows/template-fixture.yml
+++ b/.github/workflows/template-fixture.yml
@@ -30,7 +30,7 @@ jobs:
       - name: Render the released producer without tooling overrides
         timeout-minutes: 9
         run: uv run python -m scripts.render_template_fixture --output-dir "$RUNNER_TEMP/fixture"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         timeout-minutes: 1
         with:
           name: released-template-fixture
@@ -58,7 +58,7 @@ jobs:
           cp services/langgraph/requirements.lock "$RUNNER_TEMP/locks/services/langgraph/requirements.lock"
           git diff --stat -- uv.lock services/langgraph/requirements.lock | tee "$RUNNER_TEMP/locks/diffstat.txt"
           git rev-parse HEAD > "$RUNNER_TEMP/locks/candidate_sha.txt"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         timeout-minutes: 1
         with:
           name: resolved-locks