diff --git a/.github/scripts/remote-dev-workflows-policy.test.mjs b/.github/scripts/remote-dev-workflows-policy.test.mjs
index 385940e4e..a3dc06228 100644
--- a/.github/scripts/remote-dev-workflows-policy.test.mjs
+++ b/.github/scripts/remote-dev-workflows-policy.test.mjs
@@ -176,7 +176,7 @@ test("managed device exposes a secretless branch Baseline Profile artifact mode"
     assert.match(generator, /baseline-profile-log/);
     assert.match(generator, /generate\.log/);
     assert.match(generator, /app\/src\/main\/generated\/baselineProfiles\//);
-    assert.match(generator, /actions\/upload-artifact@[0-9a-f]{40} # v7\.0\.1/);
+    assert.match(generator, /actions\/upload-artifact@[0-9a-f]{40} # v\d+\.\d+\.\d+/);
     assert.match(generator, /Restore Baseline Profile generation exit code/);
     assert.doesNotMatch(generator, /secrets\./);
     assert.match(managedDevice, /!inputs\.generate_baseline_profile/);
diff --git a/.github/workflows/android-managed-device-retry.yml b/.github/workflows/android-managed-device-retry.yml
index 528b7e5dd..f0acde088 100644
--- a/.github/workflows/android-managed-device-retry.yml
+++ b/.github/workflows/android-managed-device-retry.yml
@@ -64,7 +64,7 @@ jobs:
 
       - name: Download retry marker
         if: steps.artifact.outputs.found == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ steps.artifact.outputs.name }}
           path: ${{ runner.temp }}/android-managed-device-retry
diff --git a/.github/workflows/android-managed-device.yml b/.github/workflows/android-managed-device.yml
index 5cfd3b6cf..4e41c7f4c 100644
--- a/.github/workflows/android-managed-device.yml
+++ b/.github/workflows/android-managed-device.yml
@@ -71,7 +71,7 @@ jobs:
         run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
 
       - name: Set up JDK
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: "21"
@@ -149,7 +149,7 @@ jobs:
 
       - name: Upload generated Baseline Profile and full log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: baseline-profile-${{ github.sha }}-${{ github.run_id }}
           if-no-files-found: warn
@@ -580,7 +580,7 @@ jobs:
 
       - name: Set up JDK
         if: steps.target.outputs.run_lane == 'true'
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: "21"
@@ -884,7 +884,7 @@ jobs:
         if: >-
           always() &&
           steps.infrastructure_failure.outputs.retryable == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-managed-device-retry-${{ matrix.device }}-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: error
@@ -894,7 +894,7 @@ jobs:
 
       - name: Upload androidTest reports and failure evidence
         if: always() && steps.target.outputs.run_lane == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-managed-device-${{ matrix.artifact }}-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: warn
diff --git a/.github/workflows/api-contract-smoke.yml b/.github/workflows/api-contract-smoke.yml
index fa343bae0..bb666edfc 100644
--- a/.github/workflows/api-contract-smoke.yml
+++ b/.github/workflows/api-contract-smoke.yml
@@ -53,7 +53,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload failure reports
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-wire-contract-reports-${{ github.run_id }}-${{ github.run_attempt }}
           if-no-files-found: warn
diff --git a/.github/workflows/baseline-profile.yml b/.github/workflows/baseline-profile.yml
index c14100494..b8f602307 100644
--- a/.github/workflows/baseline-profile.yml
+++ b/.github/workflows/baseline-profile.yml
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/build-cache-warm.yml b/.github/workflows/build-cache-warm.yml
index 2094bbf7a..cc1b7d4e5 100644
--- a/.github/workflows/build-cache-warm.yml
+++ b/.github/workflows/build-cache-warm.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fabfb0def..6874eb47c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -136,14 +136,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: actions
           build-mode: none
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:actions
 
@@ -173,14 +173,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: javascript-typescript
           build-mode: none
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:javascript-typescript
 
@@ -212,7 +212,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
@@ -230,7 +230,7 @@ jobs:
         uses: ./.github/actions/setup-ci-config
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: java-kotlin
           build-mode: manual
@@ -258,7 +258,7 @@ jobs:
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:java-kotlin
 
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 5ab84d9c0..35ae35b0e 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -145,7 +145,7 @@ jobs:
 
       - name: Upload machine-readable audit evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: android-dependency-audit
           path: ${{ env.REPORT_DIR }}
diff --git a/.github/workflows/dependency-submission-trusted.yml b/.github/workflows/dependency-submission-trusted.yml
index 3b21836eb..7063bd7d8 100644
--- a/.github/workflows/dependency-submission-trusted.yml
+++ b/.github/workflows/dependency-submission-trusted.yml
@@ -33,13 +33,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/dependency-submission@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           additional-arguments: --no-configuration-cache --stacktrace
           cache-provider: basic
@@ -80,13 +80,13 @@ jobs:
           echo "Submitting refs/heads/main at \`$snapshot_sha\`." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Generate and submit main dependency graph baseline
-        uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/dependency-submission@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           additional-arguments: --no-configuration-cache --stacktrace
           cache-provider: basic
diff --git a/.github/workflows/dependency-submission-upload.yml b/.github/workflows/dependency-submission-upload.yml
index 35258f36a..fb7c1fb9e 100644
--- a/.github/workflows/dependency-submission-upload.yml
+++ b/.github/workflows/dependency-submission-upload.yml
@@ -48,7 +48,7 @@ jobs:
 
       - name: Download and submit dependency graph
         if: steps.dependency-graph-artifact.outputs.available == 'true'
-        uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/dependency-submission@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           cache-disabled: true
           dependency-graph: download-and-submit
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index 2a73d6828..89c34472d 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -32,13 +32,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Generate dependency graph artifact
-        uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/dependency-submission@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           additional-arguments: --no-configuration-cache --stacktrace
           # 예외: job 간 전송용 — 제출 job 이 같은 run 안에서 소비한다 (#1400).
diff --git a/.github/workflows/firebase-wif-canary.yml b/.github/workflows/firebase-wif-canary.yml
index 074357100..2ed6765f0 100644
--- a/.github/workflows/firebase-wif-canary.yml
+++ b/.github/workflows/firebase-wif-canary.yml
@@ -85,7 +85,7 @@ jobs:
           cat "$RELEASE_NOTES_FILE" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 839de9b2e..e0fec11da 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -102,7 +102,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/qa-distribution-decision.yml b/.github/workflows/qa-distribution-decision.yml
index abf95fc5e..e0191f60e 100644
--- a/.github/workflows/qa-distribution-decision.yml
+++ b/.github/workflows/qa-distribution-decision.yml
@@ -47,7 +47,7 @@ jobs:
 
       - name: Upload decision and evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: qa-distribution-decision
           path: ${{ runner.temp }}/qa-distribution-decision
diff --git a/.github/workflows/release-aab-preflight.yml b/.github/workflows/release-aab-preflight.yml
index d6b83fb31..b8b53e191 100644
--- a/.github/workflows/release-aab-preflight.yml
+++ b/.github/workflows/release-aab-preflight.yml
@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: "21"
@@ -144,7 +144,7 @@ jobs:
             "$AFTERNOTE_CI_RELEASE_KEY_PASSWORD_FILE"
 
       - name: Upload digest and size reports only
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-aab-preflight-report
           if-no-files-found: error
diff --git a/.github/workflows/release-distribution.yml b/.github/workflows/release-distribution.yml
index 959438b44..71ceeaf19 100644
--- a/.github/workflows/release-distribution.yml
+++ b/.github/workflows/release-distribution.yml
@@ -69,7 +69,7 @@ jobs:
           cat "$RELEASE_NOTES_FILE" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/release-play-internal.yml b/.github/workflows/release-play-internal.yml
index a64d5a5a8..980b74325 100644
--- a/.github/workflows/release-play-internal.yml
+++ b/.github/workflows/release-play-internal.yml
@@ -84,7 +84,7 @@ jobs:
           fi
 
       - name: Set up JDK 21
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/screenshot-baseline-apply.yml b/.github/workflows/screenshot-baseline-apply.yml
index da2f965d8..2a538feb3 100644
--- a/.github/workflows/screenshot-baseline-apply.yml
+++ b/.github/workflows/screenshot-baseline-apply.yml
@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Download PNG artifact from triggering run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: screenshot-baseline-artifact
           path: ${{ runner.temp }}/screenshot-baseline
diff --git a/.github/workflows/screenshot-baseline-generate.yml b/.github/workflows/screenshot-baseline-generate.yml
index 3ba4977c7..6d3d92b22 100644
--- a/.github/workflows/screenshot-baseline-generate.yml
+++ b/.github/workflows/screenshot-baseline-generate.yml
@@ -218,7 +218,7 @@ jobs:
           git diff --cached --name-status
 
       - name: Upload baseline blobs for privileged validation
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: screenshot-baseline-artifact
           path: ${{ runner.temp }}/screenshot-baseline/
diff --git a/.github/workflows/screenshot.yml b/.github/workflows/screenshot.yml
index 5c283c4fa..0183b3ea2 100644
--- a/.github/workflows/screenshot.yml
+++ b/.github/workflows/screenshot.yml
@@ -152,7 +152,7 @@ jobs:
       # 실패 시 diff/rendered 이미지를 artifact 로 업로드 — 본인이 다운로드해 시각 차이 확인 가능
       - name: Upload screenshot diff on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: screenshot-test-results
           path: ${{ steps.screenshot-paths.outputs.list }}
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index be742ad23..81a429437 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -120,7 +120,7 @@ jobs:
 
       - name: Set up JDK 21
         if: inputs.gradle_tasks != ''
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -151,7 +151,7 @@ jobs:
       - name: Upload Kover coverage reports
         id: kover-artifact
         if: contains(inputs.gradle_tasks, 'kover')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: kover-jvm-coverage
           path: |
@@ -182,7 +182,7 @@ jobs:
       # 실패한 테스트의 HTML/XML 리포트를 PR artifact 로 보존 — CI 로그에서 stack trace 추적이 빠름.
       - name: Upload test reports on failure
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: unit-test-reports
           path: |