diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20338fed..7bf0e9b3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,7 +48,7 @@ jobs:
         # One cache per section: each builds a different feature and target
         # mix, so a shared cache would thrash. Only main saves, so a branch
         # or pull request can read the cache but never write into it.
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: ${{ matrix.section }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -75,7 +75,7 @@ jobs:
         # and the dev-dependency in crates/openbim-ifc/Cargo.toml; build-npm-pkg.sh
         # and check-wasm-seed.sh refuse a mismatch.
         if: matrix.section == 'bindings'
-        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
+        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
         with:
           tool: wasm-bindgen-cli@0.2.128
       - name: Set up Python
@@ -83,7 +83,7 @@ jobs:
         # clippy --all-targets, which needs libpython3.12 that the hosted
         # image no longer ships.
         if: matrix.section == 'bindings' || matrix.section == 'lint'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Install uv and maturin
diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index 76a062cb..146ad46c 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -55,12 +55,12 @@ jobs:
       - name: Cache Rust build
         # Only main saves, so a pull request can read the cache but never
         # write into it.
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: cli-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Test every command
@@ -93,7 +93,7 @@ jobs:
           components: clippy, rustfmt
           targets: ${{ matrix.target }}, wasm32-unknown-unknown
       - name: Cache Rust build
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: cli-deb-${{ matrix.target }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 833be902..1cb5c0c3 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -64,7 +64,7 @@ jobs:
       - name: Cache Rust build
         # Dependencies only. Only main saves, so a pull request can read the
         # cache but never write into it.
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: dotnet-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -73,7 +73,7 @@ jobs:
         with:
           dotnet-version: "8.0.x"
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Build, pack, and test the package from a fresh project
diff --git a/.github/workflows/native.yml b/.github/workflows/native.yml
index e4aae993..87f1474b 100644
--- a/.github/workflows/native.yml
+++ b/.github/workflows/native.yml
@@ -62,12 +62,12 @@ jobs:
       - name: Cache Rust build
         # Dependencies only. Only main saves, so a pull request can read the
         # cache but never write into it.
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: native-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Provide pkg-config
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index be1d8873..420a63b4 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3
         with:
           github_access_token: ${{ github.token }}
       - name: Evaluate every system's outputs
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 9bf9217d..e14dd9aa 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -89,7 +89,7 @@ jobs:
         with:
           node-version: '20'
           cache: npm
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
@@ -105,14 +105,14 @@ jobs:
           # built from (#331).
           targets: wasm32-unknown-unknown
       - name: Cache Rust build
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           key: pages
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Install wasm-bindgen CLI
         # Must equal the `wasm-bindgen` pin in crates/openbim-ifc-wasm/Cargo.toml;
         # build-npm-pkg.sh refuses a mismatch.
-        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
+        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
         with:
           tool: wasm-bindgen-cli@0.2.128
       - name: Install maturin and pdoc
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6995980a..8fbdecec 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -148,7 +148,7 @@ jobs:
         # exist and still be refused for the crate being released.
         id: auth
         continue-on-error: true
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
       - name: Publish
         # --publish-here skips a version that is already live, so the
         # fallback retry with the long-lived secret is safe: it can only
@@ -198,7 +198,7 @@ jobs:
         # Trusted publishing needs npm >= 11.5.1; Node 22 ships npm 10.
         run: npm install --global npm@^11.5.1 && npm --version
       - name: Install wasm-bindgen CLI
-        uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
+        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
         with:
           tool: wasm-bindgen-cli@0.2.128
       - name: Build and test the package
@@ -252,7 +252,7 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Build wheel
@@ -317,7 +317,7 @@ jobs:
       - name: List distributions
         run: ls -la dist
       - name: Publish
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           skip-existing: true
 
@@ -361,7 +361,7 @@ jobs:
           components: clippy, rustfmt
           targets: wasm32-unknown-unknown
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Provide pkg-config
@@ -426,7 +426,7 @@ jobs:
           components: clippy, rustfmt
           targets: ${{ matrix.target }}, wasm32-unknown-unknown
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Build
@@ -566,7 +566,7 @@ jobs:
         with:
           dotnet-version: "8.0.x"
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Download package