diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 64fced4b..21e4befe 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -215,7 +215,7 @@ jobs:
           skip-dirs: "unirtm_data,cmd/unirtm_data"
 
       - name: "📤 Upload Security Audit (SARIF)"
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         if: always() && matrix.os == 'ubuntu-latest'
         with:
           sarif_file: "trivy-results.sarif"
@@ -261,7 +261,7 @@ jobs:
 
       - name: "📦 Setup Node Environment (Syncing)"
         if: ${{ steps.release.outputs.pr && hashFiles('package.json') != '' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: ""
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d7b2c71..14a246c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -602,7 +602,7 @@ jobs:
           skip-dirs: "unirtm_data,cmd/unirtm_data"
 
       - name: "📤 Upload Security Audit (SARIF)"
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         if: always()
         with:
           sarif_file: "."
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9ce190c8..d9a28586 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -154,18 +154,18 @@ jobs:
           persist-credentials: false
 
       - name: "🛡️ Initialize CodeQL Engine"
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           # Sets up the CodeQL database for the specified technical stack (e.g., Python, Go).
           languages: ${{ matrix.language }}
           config-file: .github/codeql/codeql-config.yml
 
       - name: "🚀 Bootstrap Target Build"
-        uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         # Attempts to automatically compile the project to enable full-trace analysis.
 
       - name: "🔍 Perform Deep Security Analysis"
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           # Executes the semantic queries and generates the final vulnerability report.
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 00085ff4..1068e068 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -527,7 +527,7 @@ jobs:
       - name: "📤 Upload Image Security Scan (SARIF)"
         if: steps.version-filter.outputs.skip != 'true' && steps.build.conclusion == 'success' && steps.trivy.outcome == 'success'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: "trivy-image-${{ matrix.version }}.sarif"
           category: "trivy-image-debian-${{ matrix.version }}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0f934db7..669300f1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -137,6 +137,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "📤 Upload SARIF Results"
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 11ab85dd..8b06d6cc 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -122,7 +122,7 @@ jobs:
             fulcio.sigstore.dev:443
             api.sigstore.dev:443
       - name: "🧹 Mark Inactive Issues & PRs (Stale)"
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           # Automatically identifies and labels stagnant items to maintain repository focus.
           repo-token: ${{ secrets.GITHUB_TOKEN }}