diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 73d22c62..3133a319 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -67,7 +67,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -95,6 +95,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         category: "/language:${{matrix.language}}"
\ No newline at end of file
diff --git a/.github/workflows/teams-api-drift-prs.yml b/.github/workflows/teams-api-drift-prs.yml
index e181ed80..bfea8b79 100644
--- a/.github/workflows/teams-api-drift-prs.yml
+++ b/.github/workflows/teams-api-drift-prs.yml
@@ -207,7 +207,7 @@ jobs:
         continue-on-error: true
       - name: Set up Node for Copilot CLI
         if: ${{ steps.prepare-agent-context.outcome == 'success' }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - id: install-copilot-cli
@@ -247,7 +247,7 @@ jobs:
       # Upload all evidence before the final policy turns collected failures into a failed workflow.
       - name: Upload compatibility artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: teams-api-drift-pr-${{ github.run_id }}
           path: artifacts/teams-api-drift
diff --git a/.github/workflows/teams-api-drift-scheduled.yml b/.github/workflows/teams-api-drift-scheduled.yml
index d16b7011..6653ea4f 100644
--- a/.github/workflows/teams-api-drift-scheduled.yml
+++ b/.github/workflows/teams-api-drift-scheduled.yml
@@ -183,7 +183,7 @@ jobs:
       # Upload evidence before the policy gate or issue update can fail the run.
       - name: Upload scheduled drift artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: teams-api-drift-scheduled-${{ github.run_id }}
           path: artifacts/teams-api-drift
@@ -191,7 +191,7 @@ jobs:
           if-no-files-found: warn
       - name: Upload bounded publication inputs
         if: ${{ always() && steps.comparison-result.outputs.value == 'true' && hashFiles('artifacts/teams-api-drift/findings.json') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: teams-api-drift-scheduled-publication-${{ github.run_id }}
           path: |
@@ -249,14 +249,14 @@ jobs:
         run: python -m pip install --disable-pip-version-check -r scripts/teams-api-drift/requirements.txt
       - id: download-analysis
         name: Download bounded publication inputs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: teams-api-drift-scheduled-publication-${{ github.run_id }}
           path: artifacts/teams-api-drift
         continue-on-error: true
       - name: Set up Node for Copilot CLI
         if: ${{ hashFiles('artifacts/teams-api-drift/agent-context.json') != '' }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
       - id: install-copilot-cli
@@ -324,7 +324,7 @@ jobs:
             }
       - name: Upload advisory artifacts
         if: ${{ always() && hashFiles('artifacts/teams-api-drift/agent-report.md') != '' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: teams-api-drift-scheduled-advisory-${{ github.run_id }}
           path: |