diff --git a/.github/workflows/calibrate.yml b/.github/workflows/calibrate.yml
index a6f98a11..39902cc6 100644
--- a/.github/workflows/calibrate.yml
+++ b/.github/workflows/calibrate.yml
@@ -319,7 +319,7 @@ jobs:
       # artifact name cannot be uploaded twice.
       - name: Keep the games
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.ARTIFACT }}-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.rung.engine }}-${{ matrix.rung.tag }}
           path: |
@@ -359,7 +359,7 @@ jobs:
       # attempt is in the pattern so a rerun does not count an earlier
       # attempt's games as well. The prefix is followed by the run id, so a
       # blitz run's pattern cannot match a 40/15 run's artifacts.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ env.ARTIFACT }}-${{ github.run_id }}-${{ github.run_attempt }}-*
           path: rungs
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 86cb0112..3665cf44 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -30,7 +30,7 @@ jobs:
       # not in rust-toolchain.toml, so a clone does not install them
       - name: Install the llvm tools
         run: rustup component add llvm-tools-preview
-      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           # pinned for the reason the actions are
           tool: cargo-llvm-cov@0.9.0
@@ -47,7 +47,7 @@ jobs:
       # --no-run reuses the profile data the step above produced
       - name: Write the lcov
         run: cargo llvm-cov --workspace --locked --no-run --lcov --output-path lcov.info
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage
           path: lcov.info
diff --git a/.github/workflows/instructions.yml b/.github/workflows/instructions.yml
index 5dcb25df..c93d671d 100644
--- a/.github/workflows/instructions.yml
+++ b/.github/workflows/instructions.yml
@@ -61,7 +61,7 @@ jobs:
             | [range(0; length; 6) as $i | .[$i:$i + 6] | join(" ")]' commits.txt)" \
             >> "$GITHUB_OUTPUT"
       # the report reads a commit on the list with no row as a gap
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: commits
           path: commits.txt
@@ -97,7 +97,7 @@ jobs:
             --out counts.csv ${DEPTH:+--depth "$DEPTH"}
       # the rows a failed chunk did count are still worth having
       - if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.NAME }}
           path: counts.csv
@@ -111,11 +111,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: counts-*
           path: counts
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: commits
       - name: Report
@@ -136,7 +136,7 @@ jobs:
           for path in sys.argv[1:]:
               print("".join(open(path).readlines()[1:]), end="")
           EOF
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: instruction-history
           path: history.csv
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 5141d2be..147b7d49 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -48,7 +48,7 @@ jobs:
           # made the cargo-release install below a no-op with no binary there
           cache-bin: false
 
-      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           # pinned exactly, since a tool that floats makes a release
           # unreproducible: these write the release commit and the changelog,
diff --git a/.github/workflows/strength-batch.yml b/.github/workflows/strength-batch.yml
index 9a4c65c3..08e235f7 100644
--- a/.github/workflows/strength-batch.yml
+++ b/.github/workflows/strength-batch.yml
@@ -265,7 +265,7 @@ jobs:
       # artifact name cannot be uploaded twice.
       - name: Keep the games
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.ARTIFACTS }}-shard-${{ matrix.shard }}
           path: |
@@ -305,7 +305,7 @@ jobs:
       # The attempt is in the pattern so a rerun does not count an earlier
       # attempt's games as well, and the batch so a later batch does not count
       # the one before it twice, its pairs already arriving as prior_pairs.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ env.ARTIFACTS }}-shard-*
           path: shards
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index f8c7f144..b7377df0 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -38,7 +38,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # fetches a prebuilt cargo-deny rather than compiling one
-      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           # Pinned because deny.toml's fields are the ones this version
           # defines. The advisory database is still fetched at run time, which