diff --git a/.github/workflows/ci-frontend-lint.yaml b/.github/workflows/ci-frontend-lint.yaml
index 7131ecf9cc..7157903e54 100644
--- a/.github/workflows/ci-frontend-lint.yaml
+++ b/.github/workflows/ci-frontend-lint.yaml
@@ -27,13 +27,13 @@ jobs:
       frontend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.frontend == 'true' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check for frontend changes
         if: github.event_name == 'pull_request'
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Biome
         uses: biomejs/setup-biome@4c91541eaada48f67d7dbd7833600ce162b68f51 # v2.7.1
@@ -82,7 +82,7 @@ jobs:
           fi
 
       - name: Render lint report to PR
-        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: always() && hashFiles('frontend/biome-report.md') != '' && github.event.pull_request.head.repo.fork == false
         with:
           header: frontend-lint-results
@@ -106,7 +106,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
@@ -130,7 +130,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
diff --git a/.github/workflows/ci-test.yaml b/.github/workflows/ci-test.yaml
index 8509f496b3..edc3b7b8de 100644
--- a/.github/workflows/ci-test.yaml
+++ b/.github/workflows/ci-test.yaml
@@ -37,13 +37,13 @@ jobs:
       e2e_relevant: ${{ github.event_name != 'pull_request' || steps.filter.outputs.e2e_relevant == 'true' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check for changes outside ignored paths
         if: github.event_name == 'pull_request'
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           # `every`: a file counts as relevant only if it matches ALL the
@@ -70,20 +70,20 @@ jobs:
         tier: [unit, integration]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # rig --changed-only needs git history
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.6.14"
           python-version: 3.12.9
           enable-cache: true
 
       - name: Cache tox environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .tox/
           # Tier in the key: legs build different tox envs, and parallel saves
@@ -136,7 +136,7 @@ jobs:
 
       - name: Upload tier reports artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: reports-${{ matrix.tier }}
           path: reports/
@@ -159,7 +159,7 @@ jobs:
       UNSTRACT_TEST_VERSION: ${{ github.sha }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -170,20 +170,20 @@ jobs:
         # Dependabot triggers (they get only Dependabot secrets, none set), so
         # both pull anonymously and can hit Docker Hub's rate limit.
         if: (github.event.pull_request == null || github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.6.14"
           python-version: 3.12.9
           enable-cache: true
 
       - name: Cache tox environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .tox/
           key: ${{ runner.os }}-tox-uv-e2e-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }}
@@ -208,14 +208,14 @@ jobs:
         run: ./run-platform.sh -e
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Bake instead of `compose build` so each ephemeral runner restores layers
       # from the GHA cache the release workflow also writes (matching per-service
       # scopes), instead of building cold every run. `load` exports the images
       # into the daemon so the compose stack can boot them.
       - name: Build service images
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           files: ./docker/docker-compose.build.yaml
           load: true
@@ -256,7 +256,7 @@ jobs:
 
       - name: Upload e2e reports artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: reports-e2e
           path: reports/
@@ -272,19 +272,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.6.14"
           python-version: 3.12.9
           enable-cache: true
 
       - name: Cache tox environments
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .tox/
           key: ${{ runner.os }}-tox-uv-rig-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }}
@@ -304,7 +304,7 @@ jobs:
       - name: Restore main-branch test baseline (for regression detection)
         # One unified baseline across all tiers; this job is its sole
         # reader+writer. Restore-only here, save below on green main.
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: reports/previous-summary.json
           key: unstract-test-baseline-main-${{ github.run_id }}
@@ -312,7 +312,7 @@ jobs:
             unstract-test-baseline-main-
 
       - name: Download tier reports
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: reports-*
           path: reports/
@@ -335,7 +335,7 @@ jobs:
         # actions/cache saves only on a miss; the run id keys each main build a
         # fresh entry, and restore-keys' prefix pulls the latest next run.
         if: github.ref == 'refs/heads/main'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: reports/previous-summary.json
           key: unstract-test-baseline-main-${{ github.run_id }}
@@ -343,7 +343,7 @@ jobs:
       - name: Render combined test report to PR
         # Dependabot runs get a read-only GITHUB_TOKEN, so the comment would be
         # refused; skip it there like forks. The job summary still carries it.
-        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: always() && hashFiles('reports/combined-test-report.md') != '' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]'
         with:
           header: test-results
@@ -357,7 +357,7 @@ jobs:
 
       - name: Upload combined reports artifact
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-reports
           path: reports/
diff --git a/.github/workflows/docker-tools-build-push.yaml b/.github/workflows/docker-tools-build-push.yaml
index dc1173b828..1ced99355b 100644
--- a/.github/workflows/docker-tools-build-push.yaml
+++ b/.github/workflows/docker-tools-build-push.yaml
@@ -32,7 +32,7 @@ jobs:
         run: echo "${{ toJSON(github.event.inputs) }}"
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # Set up QEMU for ARM64 emulation
       - name: Set up QEMU
diff --git a/.github/workflows/production-build.yaml b/.github/workflows/production-build.yaml
index b91d35b33a..cdf649bd4c 100644
--- a/.github/workflows/production-build.yaml
+++ b/.github/workflows/production-build.yaml
@@ -109,13 +109,13 @@ jobs:
     steps:
       - name: Checkout code for release
         if: github.event_name == 'release'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Checkout code for branch
         if: github.event_name != 'release'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       # Set up QEMU for ARM64 emulation
       - name: Set up QEMU
@@ -199,7 +199,7 @@ jobs:
       # Upload status for summary job
       - name: Upload build status
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: build-status-${{ matrix.service_name }}
           path: build-status/${{ matrix.service_name }}.json
@@ -352,7 +352,7 @@ jobs:
       # Send summary notification to Slack
       - name: Send Slack summary notification
         if: always()
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           webhook-type: incoming-webhook
           payload: |
diff --git a/.github/workflows/release-notification.yaml b/.github/workflows/release-notification.yaml
index f22e832859..9bc4b5bca2 100644
--- a/.github/workflows/release-notification.yaml
+++ b/.github/workflows/release-notification.yaml
@@ -10,7 +10,7 @@ jobs:
     steps:
 
       - name: Send Slack notification
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           webhook-type: incoming-webhook
           payload: |
diff --git a/.github/workflows/uv-lock-automation.yaml b/.github/workflows/uv-lock-automation.yaml
index 38756b9765..ff28686017 100644
--- a/.github/workflows/uv-lock-automation.yaml
+++ b/.github/workflows/uv-lock-automation.yaml
@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.head_ref }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           # Install a specific version of uv.
           version: "0.6.14"