diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index 9b2b8b1e6..2517c6e75 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -136,7 +136,7 @@ jobs:
 
       - name: Mint publisher read token
         id: publisher-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -146,7 +146,7 @@ jobs:
 
       - name: Mint config source read token
         id: source-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -165,7 +165,7 @@ jobs:
           run_install: false
           cache: true
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           package-manager-cache: false
@@ -239,7 +239,7 @@ jobs:
               run_install: false
               cache: true
 
-          - uses: actions/setup-node@v7.0.0
+          - uses: actions/setup-node@v7.1.0
             with:
               node-version-file: .nvmrc
               package-manager-cache: false
diff --git a/.github/workflows/build-mobile.yml b/.github/workflows/build-mobile.yml
index 625232c0e..c11903571 100644
--- a/.github/workflows/build-mobile.yml
+++ b/.github/workflows/build-mobile.yml
@@ -128,7 +128,7 @@ jobs:
 
       - name: Mint publisher read token
         id: publisher-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -138,7 +138,7 @@ jobs:
 
       - name: Mint config source read token
         id: source-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -226,7 +226,7 @@ jobs:
 
       - name: Setup Java
         if: ${{ matrix.platform == 'android' }}
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: 17
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7f43ae3c..2c7d3cbed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Setup Rust
         id: setup-rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: "" # keep build.rustflags; the -D warnings default belongs to the Rust job's clippy call
         background: true
@@ -53,7 +53,7 @@ jobs:
               run_install: false
               cache: true
 
-          - uses: actions/setup-node@v7.0.0
+          - uses: actions/setup-node@v7.1.0
             with:
               node-version-file: .nvmrc
               package-manager-cache: false
@@ -138,7 +138,7 @@ jobs:
 
       - name: Setup Rust
         id: setup-rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: ""
         background: true
@@ -149,7 +149,7 @@ jobs:
               run_install: false
               cache: true
 
-          - uses: actions/setup-node@v7.0.0
+          - uses: actions/setup-node@v7.1.0
             with:
               node-version-file: .nvmrc
               package-manager-cache: false
@@ -200,7 +200,7 @@ jobs:
               run_install: false
               cache: true
 
-          - uses: actions/setup-node@v7.0.0
+          - uses: actions/setup-node@v7.1.0
             with:
               node-version-file: .nvmrc
               package-manager-cache: false
@@ -239,7 +239,7 @@ jobs:
               run_install: false
               cache: true
 
-          - uses: actions/setup-node@v7.0.0
+          - uses: actions/setup-node@v7.1.0
             with:
               node-version-file: .nvmrc
               package-manager-cache: false
@@ -266,7 +266,7 @@ jobs:
 
       # rustfmt and clippy come from rust-toolchain.toml's components.
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: ""
 
@@ -298,7 +298,7 @@ jobs:
 
       - name: Mint publisher read token
         id: publisher-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -308,7 +308,7 @@ jobs:
 
       - name: Mint config source read token
         id: source-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -339,7 +339,7 @@ jobs:
           version: 11.9.0
           run_install: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           package-manager-cache: false
diff --git a/.github/workflows/fast-forward.yml b/.github/workflows/fast-forward.yml
index adcbbad9b..965345d6c 100644
--- a/.github/workflows/fast-forward.yml
+++ b/.github/workflows/fast-forward.yml
@@ -30,7 +30,7 @@ jobs:
       contains(github.event.comment.body, '/ff'))
     # Pin to a 40-char commit SHA: whoever can change that repo can effectively
     # push straight to this repository's default branch.
-    uses: arcboxlabs/actions/.github/workflows/fast-forward.yml@3b936594d02e187473fbc4ec5f814bbeba2049ac # ff-v1
+    uses: arcboxlabs/actions/.github/workflows/fast-forward.yml@df45f49fc08a2237044fc03c6044b3923cae22a9 # ff-v1
     secrets:
       app_id: ${{ secrets.BOT_APP_ID }}
       app_private_key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/finalize-releases.yml b/.github/workflows/finalize-releases.yml
index 1ea4e3981..b28d637c0 100644
--- a/.github/workflows/finalize-releases.yml
+++ b/.github/workflows/finalize-releases.yml
@@ -61,7 +61,7 @@ jobs:
 
           - name: Mint release bot token
             id: release-token
-            uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+            uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
             with:
               app-id: ${{ secrets.BOT_APP_ID }}
               private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-brand-matrix.yml b/.github/workflows/release-brand-matrix.yml
index 9dcd4239c..c6093e951 100644
--- a/.github/workflows/release-brand-matrix.yml
+++ b/.github/workflows/release-brand-matrix.yml
@@ -145,7 +145,7 @@ jobs:
         with:
           run_install: false
           cache: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           package-manager-cache: false
@@ -348,7 +348,7 @@ jobs:
 
       - name: Mint publisher read token
         id: publisher-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -358,7 +358,7 @@ jobs:
 
       - name: Mint config source read token
         id: source-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -376,7 +376,7 @@ jobs:
           run_install: false
           cache: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           package-manager-cache: false
@@ -521,7 +521,7 @@ jobs:
         with:
           run_install: false
           cache: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           package-manager-cache: false
@@ -668,7 +668,7 @@ jobs:
         with:
           run_install: false
           cache: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           package-manager-cache: false
@@ -825,7 +825,7 @@ jobs:
         with:
           run_install: false
           cache: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           package-manager-cache: false
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index d6781062c..16852af5e 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -123,7 +123,7 @@ jobs:
           - name: Upload GitHub Release assets
             id: release-assets
             if: ${{ github.event_name == 'push' || inputs.dry_run == false }}
-            uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+            uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
             with:
               tag_name: ${{ steps.meta.outputs.tag }}
               # release-please creates this draft before the tag push. Keep it private while the
@@ -169,7 +169,7 @@ jobs:
         # The tap edit itself lives in arcboxlabs/homebrew-tap/.github/actions/bump-cask.
         id: tap-token
         if: ${{ (github.event_name == 'push' || inputs.dry_run == false) && startsWith(steps.meta.outputs.tag, 'v') && !contains(steps.meta.outputs.tag, '-') && env.BOT_APP_ID != '' && env.BOT_APP_PRIVATE_KEY != '' }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -204,7 +204,7 @@ jobs:
         id: winget-token
         if: ${{ (github.event_name == 'push' || inputs.dry_run == false) && startsWith(steps.meta.outputs.tag, 'v') && !contains(steps.meta.outputs.tag, '-') && env.BOT_APP_ID != '' && env.BOT_APP_PRIVATE_KEY != '' }}
         continue-on-error: true
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -216,7 +216,7 @@ jobs:
         # App installation token may be refused when opening the PR on microsoft/winget-pkgs.
         if: ${{ steps.winget-token.outputs.token != '' }}
         continue-on-error: true
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
+        uses: vedantmgoyal9/winget-releaser@b7370d4d152efdce803a26cc6ca9eee58cb2ad54 # v2
         with:
           identifier: ArcBox.LinkCode
           release-tag: ${{ steps.meta.outputs.tag }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e12162b55..7b2a3fcf6 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -23,7 +23,7 @@ jobs:
       # workflow GITHUB_TOKEN would also prevent bot-created refs from starting release workflows.
       - name: Mint release bot token
         id: release-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}