diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3dcfdcaee..c853a0489 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -138,7 +138,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           # Rust support (public preview) currently only accepts
@@ -153,6 +153,6 @@ jobs:
           # queries: security-and-quality
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/preview-artifacts.yml b/.github/workflows/preview-artifacts.yml
index ab705bc4a..f3d8d9f51 100644
--- a/.github/workflows/preview-artifacts.yml
+++ b/.github/workflows/preview-artifacts.yml
@@ -213,7 +213,7 @@ jobs:
           done
           ls -la dist/windows/
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: windows-preview-${{ needs.gate.outputs.sha }}
           path: dist/windows/
@@ -286,7 +286,7 @@ jobs:
             --target x86_64-pc-windows-msvc \
             --archive-file "uffs-tests-${{ needs.gate.outputs.sha }}.tar.zst"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: nextest-archive-${{ needs.gate.outputs.sha }}
           path: uffs-tests-${{ needs.gate.outputs.sha }}.tar.zst
@@ -314,7 +314,7 @@ jobs:
         with:
           tool: nextest
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: nextest-archive-${{ needs.gate.outputs.sha }}
 
@@ -342,7 +342,7 @@ jobs:
         with:
           ref: ${{ needs.gate.outputs.sha }}
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: preview
 
@@ -389,7 +389,7 @@ jobs:
           cat manifest.json
           echo "::endgroup::"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: manifest-${{ needs.gate.outputs.sha }}
           path: manifest.json
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 161af2ca1..18251132c 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -375,7 +375,7 @@ jobs:
         # Pinned to commit SHA of the v0.5.128 tag (resolved 2026-05-08)
         # for supply-chain hygiene.  Bump alongside other action pins
         # via the standard Dependabot or manual-refresh process.
-        uses: release-plz/action@d6c56271d640b6c1b61d1e00593641c400a9f4bd # v0.5.138
+        uses: release-plz/action@f393a7b38aca9d9b4c58447b291dbac963901df6 # v0.5.141
         with:
           command: release-pr
           config: release-plz.toml
@@ -431,7 +431,7 @@ jobs:
         # job runs on every push but only does work when the PR
         # actually merged.
         id: release-plz
-        uses: release-plz/action@d6c56271d640b6c1b61d1e00593641c400a9f4bd # v0.5.138
+        uses: release-plz/action@f393a7b38aca9d9b4c58447b291dbac963901df6 # v0.5.141
         with:
           command: release
           config: release-plz.toml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2065e7ea9..af85dde47 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -862,7 +862,7 @@ jobs:
           rm -rf release-staging demo
 
       - name: Upload release artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ${{ matrix.artifact-name }}
           path: release-artifacts/
@@ -915,7 +915,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: release-artifacts
 
diff --git a/.github/workflows/tier-2.yml b/.github/workflows/tier-2.yml
index 3047e7068..d67e2696c 100644
--- a/.github/workflows/tier-2.yml
+++ b/.github/workflows/tier-2.yml
@@ -561,7 +561,7 @@ jobs:
         # per-mutant diff, log, and overall summary in
         # `outcomes.json`.
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: cargo-mutants-output-${{ github.run_id }}
           path: mutants.out/
@@ -732,7 +732,7 @@ jobs:
         # promote to a hard gate we'll switch this to
         # `actions/cache` so each run builds on the last.
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: cargo-fuzz-output-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/winget-publish.yml b/.github/workflows/winget-publish.yml
index 3466bb62f..235cd43b7 100644
--- a/.github/workflows/winget-publish.yml
+++ b/.github/workflows/winget-publish.yml
@@ -181,7 +181,7 @@ jobs:
 
       - name: Submit manifest to winget-pkgs
         if: steps.token.outputs.present == 'true'
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
+        uses: vedantmgoyal9/winget-releaser@b7370d4d152efdce803a26cc6ca9eee58cb2ad54 # v2
         with:
           identifier: SkyLLC.UFFS
           # Match the Windows ZIP asset uploaded by release.yml. The