diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 9a3c855..cbba20a 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -25,4 +25,4 @@ jobs:
           persist-credentials: false
 
       - name: Lint workflows
-        uses: reviewdog/action-actionlint@50842263c20a7c46bd0065b9e624d3c569db061e # v1
+        uses: reviewdog/action-actionlint@619a81ec64ff8c0211cd6146eb2b21e8f1d7f440 # v1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f54a78..3d2dd3f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
         run: npm run test:coverage
 
       - name: Upload coverage evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: node-coverage
           path: coverage/
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d91afa9..47a7284 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,16 +29,16 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
 
       - name: Fail on blocking code-scanning alerts
         uses: edithatogo/.github/.github/actions/code-scanning-gate@90b399a731a17b792352d0c049834a22dbd32523
diff --git a/.github/workflows/registry-monitor.yml b/.github/workflows/registry-monitor.yml
index 4907b39..4c0ecd6 100644
--- a/.github/workflows/registry-monitor.yml
+++ b/.github/workflows/registry-monitor.yml
@@ -31,7 +31,7 @@ jobs:
           --issue-body registry-drift.md
 
       - name: Upload monitor artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: registry-distribution-drift
           path: registry-drift.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 103faba..ac16f2c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
           test -f distribution-staging/portable/distribution-receipt.json
 
       - name: Upload distribution packages
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: authentext-distribution-packages
           path: distribution-staging
@@ -84,7 +84,7 @@ jobs:
           grep -Fx 'references/reasoning-failures.md' artifact-contents.txt
 
       - name: Upload release artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: authentext-skill-artifacts
           path: |
@@ -95,7 +95,7 @@ jobs:
 
       - name: Publish GitHub release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: |
             authentext-skill-artifacts.tar.gz
diff --git a/.github/workflows/renovate-hosted-monitor.yml b/.github/workflows/renovate-hosted-monitor.yml
index 1f46040..e256f29 100644
--- a/.github/workflows/renovate-hosted-monitor.yml
+++ b/.github/workflows/renovate-hosted-monitor.yml
@@ -40,7 +40,7 @@ jobs:
           fi
 
       - name: Upload evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: renovate-hosted-evidence
           path: renovate-hosted.json
diff --git a/.github/workflows/self-improvement.yml b/.github/workflows/self-improvement.yml
index d6f69fb..87815e9 100644
--- a/.github/workflows/self-improvement.yml
+++ b/.github/workflows/self-improvement.yml
@@ -74,13 +74,13 @@ jobs:
           npm test
 
       - name: Upload Baseline Metrics
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: baseline-metrics
           path: metrics-baseline.txt
 
       - name: Upload self-improvement data
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: self-improvement-data
           path: |
diff --git a/.github/workflows/skill-distribution.yml b/.github/workflows/skill-distribution.yml
index 889e6c6..2911d3e 100644
--- a/.github/workflows/skill-distribution.yml
+++ b/.github/workflows/skill-distribution.yml
@@ -28,7 +28,7 @@ jobs:
         run: npm run evaluate -- --output-dir "${RUNNER_TEMP}/authentext-evaluations"
 
       - name: Upload machine-readable evaluation receipts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: authentext-evaluation-results
           path: ${{ runner.temp }}/authentext-evaluations/*.json
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
-          python-version: '3.13'
+          python-version: '3.15'
 
       - name: Install the reference Agent Skills validator
         run: python -m pip install skills-ref==0.1.1