diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9ecff8f4..e79b0f41e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -185,7 +185,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: platform-all-features
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -207,13 +207,13 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: platform-coverage
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install pinned coverage tool
-        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
         with:
           tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}
 
@@ -256,7 +256,7 @@ jobs:
       id-token: write
     steps:
       - name: Download platform coverage
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: platform-coverage
           path: target/platform-coverage
@@ -314,13 +314,13 @@ jobs:
           toolchain: nightly
 
       - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: platform-fuzz-${{ matrix.target }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install pinned cargo-fuzz
-        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
         with:
           tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}
 
@@ -356,14 +356,14 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
         with:
           tool: cargo-deny@0.19.8
 
@@ -394,7 +394,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
@@ -432,7 +432,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
@@ -466,7 +466,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
@@ -510,14 +510,14 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.11.16"
 
@@ -544,7 +544,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
@@ -573,7 +573,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
@@ -599,7 +599,7 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
@@ -824,7 +824,7 @@ jobs:
           cache-dependency-path: docs/site/package-lock.json
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f769f9b1a..403d8ca26 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,13 +38,13 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/nightly-rust-coverage.yml b/.github/workflows/nightly-rust-coverage.yml
index 1db37c54e..9a3e8bedb 100644
--- a/.github/workflows/nightly-rust-coverage.yml
+++ b/.github/workflows/nightly-rust-coverage.yml
@@ -99,14 +99,14 @@ jobs:
           submodules: false
 
       - name: Cache Cargo registry
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: workspace-registry
           cache-targets: false
           save-if: false
 
       - name: Install pinned coverage tool
-        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
         with:
           tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}
 
diff --git a/.github/workflows/nightly-security.yml b/.github/workflows/nightly-security.yml
index cb98b24ad..35ac91c9b 100644
--- a/.github/workflows/nightly-security.yml
+++ b/.github/workflows/nightly-security.yml
@@ -77,10 +77,10 @@ jobs:
           toolchain: nightly
 
       - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
 
       - name: Install cargo-fuzz
-        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
         with:
           tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}
 
@@ -127,10 +127,10 @@ jobs:
           toolchain: nightly
 
       - name: Cache Cargo registry and build artifacts
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
 
       - name: Install cargo-fuzz
-        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
         with:
           tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}
 
diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py
index 578f7c00b..8b0371db7 100644
--- a/release/scripts/check-gates-inventory.py
+++ b/release/scripts/check-gates-inventory.py
@@ -1063,7 +1063,7 @@ def platform_coverage_oidc_isolation_violations(workflow: str | None) -> list[st
         or not upload_steps_text.startswith("      - ")
         or upload_steps_text.count("        uses:") != 2
         or len(upload_steps) != 2
-        or "uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093"
+        or "uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
         not in upload_steps[0]
         or "uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f"
         not in upload_steps[1]