diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b19368f..bd67ae7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,4 +23,4 @@ permissions:
 jobs:
   check:
     name: CI
-    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3dec3c5..2757aa6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,4 +20,4 @@ jobs:
       packages: read
       actions: read
       contents: read
-    uses: kirchDev/workflows/.github/workflows/_codeql.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_codeql.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
diff --git a/.github/workflows/fast-forward-queue.yml b/.github/workflows/fast-forward-queue.yml
index 03321fd..dfbb9b4 100644
--- a/.github/workflows/fast-forward-queue.yml
+++ b/.github/workflows/fast-forward-queue.yml
@@ -25,7 +25,7 @@ jobs:
       pull-requests: read
       checks: read
       statuses: read
-    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
     with:
       pr: ${{ inputs.pr }}
     secrets:
diff --git a/.github/workflows/promotion-pr.yml b/.github/workflows/promotion-pr.yml
index ccc6ddb..f03dcbc 100644
--- a/.github/workflows/promotion-pr.yml
+++ b/.github/workflows/promotion-pr.yml
@@ -15,4 +15,4 @@ permissions:
 jobs:
   promotion-pr:
     name: Promotion PR
-    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
diff --git a/.github/workflows/queue-branch.yml b/.github/workflows/queue-branch.yml
index 53bb195..48252d9 100644
--- a/.github/workflows/queue-branch.yml
+++ b/.github/workflows/queue-branch.yml
@@ -16,6 +16,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
     secrets:
       BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 01fa159..a0fb9ff 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_release-please.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_release-please.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
     with:
       # This package is consumed as `kirchDev/gitignore-sync@<ref>`, so `@v0`
       # has to keep meaning "the newest v0.x.y".
@@ -43,7 +43,7 @@ jobs:
     # `build-script` is left at its default: this repo's `build` writes the npm
     # artifact itself. coverage-report needs `build:npm` there only because its
     # `build` produces an Action bundle instead.
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
     with:
       tag-name: ${{ needs.release-please.outputs.tag-name }}
 
@@ -73,6 +73,6 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@4767c07534dcf886d6a387f29dc70a097b44c591 # v0.14.0
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@17381dcb03641c3e720449c345afeefa1365a329 # v0.17.0
     with:
       prerelease: true
diff --git a/.github/workflows/sea.yml b/.github/workflows/sea.yml
index bd519ef..94c67ac 100644
--- a/.github/workflows/sea.yml
+++ b/.github/workflows/sea.yml
@@ -66,7 +66,7 @@ jobs:
           # build time. Empty on a pull request, which checks out its own head.
           ref: ${{ inputs.tag-name }}
 
-      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - uses: actions/setup-node@v7
         with: