diff --git a/.github/workflows/reusable_claude_pr_review.yml b/.github/workflows/reusable_claude_pr_review.yml
index b2935b7..5cf09a6 100644
--- a/.github/workflows/reusable_claude_pr_review.yml
+++ b/.github/workflows/reusable_claude_pr_review.yml
@@ -488,7 +488,7 @@ jobs:
 
       - name: Upload review results
         if: ${{ !cancelled() && steps.prepare.outcome == 'success' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           # One name per run, not per attempt: re-running only a failed post
           # job starts a new attempt that downloads the review job's artifact
diff --git a/.github/workflows/reusable_codeql.yml b/.github/workflows/reusable_codeql.yml
index 625e0e8..0a023d9 100644
--- a/.github/workflows/reusable_codeql.yml
+++ b/.github/workflows/reusable_codeql.yml
@@ -27,11 +27,11 @@ jobs:
     
      # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         queries: +security-and-quality
         languages: ${{inputs.languages}}
         build-mode: ${{inputs.mode }}
     
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/reusable_extract_pr_details.yml b/.github/workflows/reusable_extract_pr_details.yml
index 282af27..71fc731 100644
--- a/.github/workflows/reusable_extract_pr_details.yml
+++ b/.github/workflows/reusable_extract_pr_details.yml
@@ -35,7 +35,7 @@ jobs:
       pr_action: ${{ steps.extract-pr-details.outputs.pr_action }}
     steps:
       - name: Download PR artifact
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           WORKFLOW_ID: ${{ inputs.record_pr_workflow_id }}
           ARTIFACT_NAME: ${{ inputs.artifact_name }}
diff --git a/.github/workflows/reusable_prerelease.yml b/.github/workflows/reusable_prerelease.yml
index 71f462b..5076578 100644
--- a/.github/workflows/reusable_prerelease.yml
+++ b/.github/workflows/reusable_prerelease.yml
@@ -45,7 +45,7 @@ jobs:
           tag: ${{ inputs.tag }}
 
       - name: UploadArtifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: build-artifact
           path: |
diff --git a/.github/workflows/reusable_publish_v2.yml b/.github/workflows/reusable_publish_v2.yml
index 975b9e4..93072cf 100644
--- a/.github/workflows/reusable_publish_v2.yml
+++ b/.github/workflows/reusable_publish_v2.yml
@@ -123,7 +123,7 @@ jobs:
           tag: ${{ env.TAG }}
 
       - name: UploadArtifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: build-artifact
           path: |
diff --git a/.github/workflows/reusable_record_pr_details.yml b/.github/workflows/reusable_record_pr_details.yml
index 08f7ad9..8c11c0a 100644
--- a/.github/workflows/reusable_record_pr_details.yml
+++ b/.github/workflows/reusable_record_pr_details.yml
@@ -24,7 +24,7 @@ jobs:
           echo "$PR_ACTION" > ./pr-info/pr-action.txt
       
       - name: Upload PR info artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pr-info
           path: ./pr-info/
diff --git a/.github/workflows/reusable_security_scan.yml b/.github/workflows/reusable_security_scan.yml
index a6725a4..08a80ff 100644
--- a/.github/workflows/reusable_security_scan.yml
+++ b/.github/workflows/reusable_security_scan.yml
@@ -63,7 +63,7 @@ jobs:
         # zizmor exits non-zero when it reports findings, so the job fails on any
         # finding at or above min-severity. No continue-on-error: the check is a
         # gate, not advisory.
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           # Scope to .github/ so the nested central-config checkout at
           # .zizmor-config/ is not itself scanned. All workflows and composite
diff --git a/.github/workflows/reusable_stale_prs_and_issues.yml b/.github/workflows/reusable_stale_prs_and_issues.yml
index 71d090d..980eaea 100644
--- a/.github/workflows/reusable_stale_prs_and_issues.yml
+++ b/.github/workflows/reusable_stale_prs_and_issues.yml
@@ -11,7 +11,7 @@ jobs:
   stale-review-stage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           debug-only: false
           repo-token: ${{ secrets.GITHUB_TOKEN }}