diff --git a/.github/workflows/measure-classic-check.yml b/.github/workflows/measure-classic-check.yml
index 86ef21b..cd0731b 100644
--- a/.github/workflows/measure-classic-check.yml
+++ b/.github/workflows/measure-classic-check.yml
@@ -182,7 +182,7 @@ jobs:
             >> "${GITHUB_STEP_SUMMARY}"
 
       - name: Upload measured native Windows test bundle
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: classic-check-measured-native-windows-tests
           path: build/classic/libatrinik/build/windows-test-bundle
@@ -190,7 +190,7 @@ jobs:
           retention-days: 1
 
       - name: Upload image measurements
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: classic-check-image-measurements
           path: build/measurements
@@ -205,7 +205,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download measured native Windows test bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: classic-check-measured-native-windows-tests
           path: build/native-windows-tests
diff --git a/.github/workflows/publish-linux.yml b/.github/workflows/publish-linux.yml
index 5192f1d..76341b6 100644
--- a/.github/workflows/publish-linux.yml
+++ b/.github/workflows/publish-linux.yml
@@ -394,7 +394,7 @@ jobs:
 
       # Upload is part of acceptance: an unavailable receipt blocks every alias.
       - name: Retain published identity evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: linux-published-identity-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/linux-published-identity/${{ github.run_id }}-${{ github.run_attempt }}
@@ -429,7 +429,7 @@ jobs:
 
       - name: Retain failed identity evidence
         if: ${{ failure() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: linux-published-identity-failure-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/linux-published-identity/${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/publish-windows.yml b/.github/workflows/publish-windows.yml
index 60e0bf3..9d1a848 100644
--- a/.github/workflows/publish-windows.yml
+++ b/.github/workflows/publish-windows.yml
@@ -197,7 +197,7 @@ jobs:
             '
 
       - name: Upload release native Windows test bundle
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: classic-check-release-native-windows-tests
           path: build/classic/libatrinik/build/windows-test-bundle
@@ -212,7 +212,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download release native Windows test bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: classic-check-release-native-windows-tests
           path: build/native-windows-tests
diff --git a/.github/workflows/qualify-released-linux-sdk.yml b/.github/workflows/qualify-released-linux-sdk.yml
index a4a1e02..10dcf9d 100644
--- a/.github/workflows/qualify-released-linux-sdk.yml
+++ b/.github/workflows/qualify-released-linux-sdk.yml
@@ -70,7 +70,7 @@ jobs:
 
       - name: Retain bounded identity receipts
         if: ${{ always() && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: released-linux-sdk-${{ matrix.target }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: build/released-sdk-evidence/${{ matrix.target }}/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fec5ebd..5967011 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24.18.1
       - name: Verify release branch policy
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index b2199a8..bc1ab63 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -425,7 +425,7 @@ jobs:
         run: tools/smoke-classic-check.sh "${CANDIDATE_IMAGE}" build/classic
 
       - name: Upload native Windows test bundle
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: classic-check-native-windows-tests
           path: build/classic/libatrinik/build/windows-test-bundle
@@ -443,7 +443,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download native Windows test bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: classic-check-native-windows-tests
           path: build/native-windows-tests
@@ -610,7 +610,7 @@ jobs:
 
       - name: Retain portable consumer and ABI evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: classic-portable-consumer-evidence
           path: build/portable-reports
diff --git a/.github/workflows/windows-glib-qualification.yml b/.github/workflows/windows-glib-qualification.yml
index 4707e6f..35606ea 100644
--- a/.github/workflows/windows-glib-qualification.yml
+++ b/.github/workflows/windows-glib-qualification.yml
@@ -154,7 +154,7 @@ jobs:
           PY
 
       - name: Upload bounded native library bundle
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: windows-glib-cairo-tls-native-bundle
           path: build/glib-native-bundle
@@ -163,7 +163,7 @@ jobs:
 
       - name: Retain cross-build evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: windows-glib-cairo-tls-cross-build-evidence
           path: |
@@ -180,7 +180,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Download scoped native GLib and Cairo bundles
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: windows-glib-cairo-tls-native-bundle
           path: build/glib-native-bundle
@@ -207,7 +207,7 @@ jobs:
 
       - name: Retain native TLS qualification evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: windows-glib-tls-native-evidence
           path: |