diff --git a/.github/actions/run-claude-review-attempt/action.yml b/.github/actions/run-claude-review-attempt/action.yml
index e5d41fc8e..3be1ce80e 100644
--- a/.github/actions/run-claude-review-attempt/action.yml
+++ b/.github/actions/run-claude-review-attempt/action.yml
@@ -190,7 +190,7 @@ runs:
   steps:
     - name: Run Claude Code Review
       id: run
-      uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+      uses: anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c # v1.0.268
       with:
         claude_code_oauth_token: ${{ inputs.claude-code-oauth-token }}
         anthropic_api_key: ${{ inputs.anthropic-api-key }}
diff --git a/.github/workflows/check-dependency-updates.yml b/.github/workflows/check-dependency-updates.yml
index 71bb033ed..9f1316dc9 100644
--- a/.github/workflows/check-dependency-updates.yml
+++ b/.github/workflows/check-dependency-updates.yml
@@ -85,7 +85,7 @@ jobs:
       - name: Run Claude Dependency Auditor
         id: claude
         if: steps.preflight-quota.outputs.quota_exhausted != 'true' && steps.preflight-credential.outputs.malformed != 'true'
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+        uses: anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c # v1.0.268
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TARGET_REPO: ${{ inputs.target-repo }}
diff --git a/.github/workflows/claude-manage-project.yml b/.github/workflows/claude-manage-project.yml
index bdf62e583..a0c87e8be 100644
--- a/.github/workflows/claude-manage-project.yml
+++ b/.github/workflows/claude-manage-project.yml
@@ -60,7 +60,7 @@ jobs:
       repository-projects: write
     steps:
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d  # v1.0.266
+        uses: anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c  # v1.0.268
         env:
           # Prefer a Projects-capable token when the consumer supplies one.
           # NOTE: this is step-global. When PROJECTS_TOKEN is supplied it
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index bd4854dbc..e4ecc32f6 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -876,7 +876,7 @@ jobs:
       - name: Run Claude Code
         id: claude
         if: steps.gate.outputs.skip != 'true'
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+        uses: anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c # v1.0.268
         # GH_TOKEN authenticates the `gh` commands granted in claude-args
         # (gh pr view/diff/edit, gh issue view, gh api); without it `gh`
         # prompts and fails in CI.
diff --git a/.github/workflows/opposition-research.yml b/.github/workflows/opposition-research.yml
index 3fb56adec..6ee2ad6e2 100644
--- a/.github/workflows/opposition-research.yml
+++ b/.github/workflows/opposition-research.yml
@@ -94,7 +94,7 @@ jobs:
       - name: Run Claude Opposition Research
         id: claude
         if: steps.preflight-quota.outputs.quota_exhausted != 'true' && steps.preflight-credential.outputs.malformed != 'true'
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+        uses: anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c # v1.0.268
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COMPETITOR: ${{ inputs.competitor }}
diff --git a/.github/workflows/summary.yml b/.github/workflows/summary.yml
index 0978e6bcc..9ca59a6fd 100644
--- a/.github/workflows/summary.yml
+++ b/.github/workflows/summary.yml
@@ -72,7 +72,7 @@ jobs:
         id: claude
         if: steps.token.outputs.available == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
+        uses: anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c # v1.0.268
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the App-token exchange: its default permissions are write,
diff --git a/check-code-similarity/action.yml b/check-code-similarity/action.yml
index a4883051e..48b21e38e 100644
--- a/check-code-similarity/action.yml
+++ b/check-code-similarity/action.yml
@@ -107,7 +107,7 @@ runs:
   using: composite
   steps:
     - name: Set up Java
-      uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+      uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
       with:
         distribution: temurin
         java-version: ${{ inputs.java-version }}
diff --git a/check-formatting/action.yml b/check-formatting/action.yml
index eff340d64..838ed8ead 100644
--- a/check-formatting/action.yml
+++ b/check-formatting/action.yml
@@ -28,7 +28,7 @@ runs:
   using: composite
   steps:
     - name: Install Air
-      uses: posit-dev/setup-air@cf390573ff4fe0f198f35df3a642b1409328d859 # v1.0.1
+      uses: posit-dev/setup-air@fd20dd239848b9d807848a7ab92265cf197de694 # v1.0.2
       with:
         version: ${{ inputs.version }}
         github-token: ${{ github.token }}