diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ef608f..530e2c0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,10 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action/*"
   - package-ecosystem: "npm"
     directory: "/.deepsec"
     schedule:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 17fd645..983aa3a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,13 +18,18 @@ jobs:
     name: Analyze (Java/Kotlin)
     runs-on: ubuntu-latest
     timeout-minutes: 360
+    env:
+      CODEQL_BUNDLE_SHA256: 5bbf89fc9e818dbb45502c6697fe5806a17b868fba802f6e27e91110f84036b5
+      CODEQL_BUNDLE_URL: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260724/codeql-bundle-linux64.tar.zst
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -34,16 +39,27 @@ jobs:
         with:
           packages: platform-tools platforms;android-37.0
 
+      - name: Download verified CodeQL bundle
+        id: codeql-bundle
+        shell: bash
+        run: |
+          bundle_path="$RUNNER_TEMP/codeql-bundle-20260724-linux64.tar.zst"
+          curl --proto '=https' --proto-redir '=https' --fail --location --retry 3 --output "$bundle_path" "$CODEQL_BUNDLE_URL"
+          echo "$CODEQL_BUNDLE_SHA256  $bundle_path" | sha256sum --check --strict
+          echo "path=$bundle_path" >> "$GITHUB_OUTPUT"
+
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # Lukittu versioon v4.37.0.
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3.
         with:
           languages: java-kotlin
           build-mode: manual
+          # CodeQL 2.26.1 ei tue Kotlin 2.4.10:tä. Poista pin, kun vakaa bundle sisältää tuen.
+          tools: ${{ steps.codeql-bundle.outputs.path }}
 
       - name: Build with Gradle
         run: ./gradlew assembleDebug --no-daemon
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # Lukittu versioon v4.37.0.
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3.
         with:
           category: "/language:java-kotlin"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8592ecb..32f0f37 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,10 +17,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: 'temurin'
diff --git a/.github/workflows/qodana.yml b/.github/workflows/qodana.yml
index b219b6d..64d48a1 100644
--- a/.github/workflows/qodana.yml
+++ b/.github/workflows/qodana.yml
@@ -16,10 +16,11 @@ jobs:
     name: Qodana Analysis (non-blocking AGP 9.3 risk)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Qodana Scan
         uses: JetBrains/qodana-action@4861e015da555e86a72b862892aba6c2b93e6891 # Lukittu versioon v2026.1.3.
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 959b9c8..3604b3f 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -17,10 +17,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: temurin
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 4f958c9..9da2cbb 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -21,7 +21,9 @@ jobs:
     container:
       image: semgrep/semgrep:1.162.0@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
+        with:
+          persist-credentials: false
       - run: >
           semgrep scan
           --error
@@ -35,7 +37,7 @@ jobs:
           --sarif
           --output semgrep.sarif
           .
-      - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.0.
+      - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # Lukittu versioon v4.37.3.
         if: always() && hashFiles('semgrep.sarif') != ''
         with:
           sarif_file: semgrep.sarif
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 03bb79c..0f76b74 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -16,12 +16,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # Lukittu versioon v6.0.3.
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Lukittu versioon v7.0.1.
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up JDK 21
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.3.0.
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # Lukittu versioon v5.6.0.
         with:
           java-version: '21'
           distribution: 'temurin'