diff --git a/.github/workflows/build-cache-warm.yml b/.github/workflows/build-cache-warm.yml
index 63e75d8..783b087 100644
--- a/.github/workflows/build-cache-warm.yml
+++ b/.github/workflows/build-cache-warm.yml
@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f7cc6ce..2936d58 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -137,14 +137,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: actions
           build-mode: none
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:actions
 
@@ -174,14 +174,14 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: javascript-typescript
           build-mode: none
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:javascript-typescript
 
@@ -213,7 +213,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
@@ -231,7 +231,7 @@ jobs:
         uses: ./.github/actions/setup-ci-config
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: java-kotlin
           build-mode: manual
@@ -249,7 +249,7 @@ jobs:
 
       - name: Analyze and upload CodeQL results
         id: analyze
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:java-kotlin
 
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index c49c1e1..da8d40e 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/dependency-submission-trusted.yml b/.github/workflows/dependency-submission-trusted.yml
index 4340168..9fe4c71 100644
--- a/.github/workflows/dependency-submission-trusted.yml
+++ b/.github/workflows/dependency-submission-trusted.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index 6ffbcac..6a00ad8 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/firebase-wif-canary.yml b/.github/workflows/firebase-wif-canary.yml
index 2bce266..a911fac 100644
--- a/.github/workflows/firebase-wif-canary.yml
+++ b/.github/workflows/firebase-wif-canary.yml
@@ -85,7 +85,7 @@ jobs:
           cat "$RELEASE_NOTES_FILE" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/firestore-rules.yml b/.github/workflows/firestore-rules.yml
index a1734ff..f49fc47 100644
--- a/.github/workflows/firestore-rules.yml
+++ b/.github/workflows/firestore-rules.yml
@@ -40,7 +40,7 @@ jobs:
 
       # 에뮬레이터는 JVM 위에서 돈다.
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index cb7b8e0..026c992 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -98,7 +98,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/release-aab-preflight.yml b/.github/workflows/release-aab-preflight.yml
index b8e0140..d9de1cc 100644
--- a/.github/workflows/release-aab-preflight.yml
+++ b/.github/workflows/release-aab-preflight.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: "21"
diff --git a/.github/workflows/release-distribution.yml b/.github/workflows/release-distribution.yml
index 0ef7742..ca8bec0 100644
--- a/.github/workflows/release-distribution.yml
+++ b/.github/workflows/release-distribution.yml
@@ -72,7 +72,7 @@ jobs:
           cat "$RELEASE_NOTES_FILE" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/release-play-internal.yml b/.github/workflows/release-play-internal.yml
index 371acc0..9d24634 100644
--- a/.github/workflows/release-play-internal.yml
+++ b/.github/workflows/release-play-internal.yml
@@ -72,7 +72,7 @@ jobs:
           fi
 
       - name: Set up JDK 21
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/screenshot-baseline-generate.yml b/.github/workflows/screenshot-baseline-generate.yml
index d6b85f2..18788a3 100644
--- a/.github/workflows/screenshot-baseline-generate.yml
+++ b/.github/workflows/screenshot-baseline-generate.yml
@@ -55,10 +55,10 @@ jobs:
           fi
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build CI screenshot image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: Dockerfile.screenshot
diff --git a/.github/workflows/screenshot.yml b/.github/workflows/screenshot.yml
index 06f5e38..d66e19d 100644
--- a/.github/workflows/screenshot.yml
+++ b/.github/workflows/screenshot.yml
@@ -53,10 +53,10 @@ jobs:
       # 동일 이미지에서 baseline 생성·검증을 수행해 anti-aliasing/font/scale 등 host 환경 차이 root fix.
       # Dockerfile 변경 없으면 cache 재사용 — 분당 단위 추가 비용.
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build screenshot image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: Dockerfile.screenshot
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 54929c4..cedb226 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Set up JDK 21
         if: inputs.gradle_tasks != ''
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: 'temurin'
           java-version: '21'