diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9510bcdc..c32381ef 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,6 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with: {languages: python,javascript-typescript}
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/engineering-platform-validation.yml b/.github/workflows/engineering-platform-validation.yml
index 55076d8a..8acb6afd 100644
--- a/.github/workflows/engineering-platform-validation.yml
+++ b/.github/workflows/engineering-platform-validation.yml
@@ -243,7 +243,7 @@ jobs:
         run: npm run test:engineering-dashboard -- --shard=${{ matrix.shard }}
       - name: Upload Engineering Status browser screenshots
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engineering-status-browser-screenshots-${{ matrix.artifact_suffix }}
           path: |
@@ -257,7 +257,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with: {node-version: '24'}
       - run: npm ci
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
@@ -266,7 +266,7 @@ jobs:
           path: browser-shard-evidence
       - name: Enforce all selected production JavaScript files strictly above 80.2 percent
         run: node tools/qualification/dashboard_js_coverage.mjs . browser-shard-evidence dashboard-executable-coverage.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: dashboard-executable-coverage
@@ -279,7 +279,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v22
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v22
         with: {node-version: '22'}
       - name: Install pinned browser validation dependencies
         run: npm ci --ignore-scripts
diff --git a/.github/workflows/ep-server-production-release.yml b/.github/workflows/ep-server-production-release.yml
index 671c25d0..e121f2e9 100644
--- a/.github/workflows/ep-server-production-release.yml
+++ b/.github/workflows/ep-server-production-release.yml
@@ -138,7 +138,7 @@ jobs:
           "$RUNNER_TEMP/ep-production/bin/engineering-platform-server" --help >/dev/null
       - name: Generate SBOM for the exact release runtime
         run: cyclonedx-py environment --output-file dist/engineering-platform.cdx.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engineering-platform-production-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: dist/
@@ -156,7 +156,7 @@ jobs:
           ref: ${{ needs.release-context.outputs.candidate_sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with: {python-version: '3.14'}
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v22
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v22
         with: {node-version: '22'}
       - run: python3 -m pip install . && npm ci && npx playwright install --with-deps chromium
       # Execute the same bounded four-part coordinator as local qualification;
@@ -178,7 +178,7 @@ jobs:
           ref: ${{ needs.release-context.outputs.candidate_sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with: {python-version: '3.14'}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: engineering-platform-production-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: dist
@@ -267,7 +267,7 @@ jobs:
             cmp "$QUALIFIED" "$RUNNER_TEMP/$QUALIFIED"
           fi
           rm -f pypi.json "$QUALIFIED"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engineering-platform-qualified-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: |
@@ -293,7 +293,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with:
           ref: ${{ needs.release-context.outputs.candidate_sha }}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: engineering-platform-qualified-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: release-input
@@ -398,7 +398,7 @@ jobs:
           ref: ${{ needs.release-context.outputs.candidate_sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with: {python-version: '3.14'}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: engineering-platform-qualified-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: release-input
@@ -520,7 +520,7 @@ jobs:
             ep_draft_upload "$DRAFT_ID" "$RECEIPT" "$RECEIPT"
           fi
           rm -f "$RECEIPT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engineering-platform-published-evidence-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: |
@@ -541,7 +541,7 @@ jobs:
           ref: ${{ needs.release-context.outputs.candidate_sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with: {python-version: '3.14'}
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: engineering-platform-published-evidence-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: published-input
@@ -771,7 +771,7 @@ jobs:
             gh release upload "$TAG" "$RECEIPT"
             gh release download "$TAG" --pattern "$RECEIPT" --output - | cmp "$RECEIPT" -
           fi
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engineering-platform-release-evidence-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }}
           path: engineering-platform-release-complete-*.json
diff --git a/.github/workflows/owner-authorization.yml b/.github/workflows/owner-authorization.yml
index 4af01a74..ac85c52c 100644
--- a/.github/workflows/owner-authorization.yml
+++ b/.github/workflows/owner-authorization.yml
@@ -116,7 +116,7 @@ jobs:
           script: |
             const [targetOwner, targetRepo] = process.env.TARGET_REPOSITORY.split("/");
             await github.rest.repos.createCommitStatus({owner: targetOwner, repo: targetRepo, sha: process.env.TARGET_SHA, context: "Owner Authorization", state: "success", description: "HIGH_RISK authorized for this exact SHA", target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`});
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: trusted-delivery-owner-authorization-evidence
           path: owner-authorization-evidence.json
diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml
index e7a8d35d..983e0f9f 100644
--- a/.github/workflows/security-baseline.yml
+++ b/.github/workflows/security-baseline.yml
@@ -30,7 +30,7 @@ jobs:
           python -m build
           sha256sum dist/* > dist/SHA256SUMS
           cyclonedx-py environment --output-file dist/engineering-platform.cdx.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engineering-platform-supply-chain-evidence
           path: dist/
diff --git a/.github/workflows/tde-observe.yml b/.github/workflows/tde-observe.yml
index 9b1c5bfe..fb08aeb1 100644
--- a/.github/workflows/tde-observe.yml
+++ b/.github/workflows/tde-observe.yml
@@ -62,7 +62,7 @@ jobs:
           printf 'assessment_exit=%s\nqualification_exit=%s\n' "$assessment_exit" "$qualification_exit" > tde-observe/summary.txt
       - name: Publish TDE observe evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: tde-observe-evidence
           path: |