diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 91e8b1d8..72b83167 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -27,7 +27,7 @@ workflows:
         - 'swatinem/rust-cache@v2.9.2'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.37.7'
+        - 'github/codeql-action@v4.37.9'
     '.github/workflows/container-ci.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/dogfood-gate.yml':
@@ -58,10 +58,10 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@master'
         - 'swatinem/rust-cache@v2.9.2'
-        - 'taiki-e/install-action@v2.86.4'
+        - 'taiki-e/install-action@v2.87.3'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/deploy-pages@v5.0.0'
+        - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
     '.github/workflows/proof-safety.yml':
         - 'actions/checkout@v7.0.1'
@@ -76,7 +76,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@master'
         - 'swatinem/rust-cache@v2.9.2'
-        - 'taiki-e/install-action@v2.86.4'
+        - 'taiki-e/install-action@v2.87.3'
     '.github/workflows/scorecard.yml': []
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/security-scan.yml': []
@@ -112,9 +112,9 @@ dependencies:
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
-    'actions/deploy-pages@v5.0.0':
-        ref: 'v5.0.0'
-        commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128'
+    'actions/deploy-pages@v5.0.1':
+        ref: 'v5.0.1'
+        commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
     'actions/download-artifact@v8.0.1':
@@ -144,9 +144,9 @@ dependencies:
         commit: 'sha1-d1031067263f94b142dd6c0ce24c5eb9d02d52a0'
         owner_id: 1940490
         repo_id: 260749683
-    'github/codeql-action@v4.37.7':
-        ref: 'v4.37.7'
-        commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd'
+    'github/codeql-action@v4.37.9':
+        ref: 'v4.37.9'
+        commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
         owner_id: 9919
         repo_id: 259445878
     'google/clusterfuzzlite@v1':
@@ -174,8 +174,8 @@ dependencies:
         commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
         owner_id: 580492
         repo_id: 298565987
-    'taiki-e/install-action@v2.86.4':
-        ref: 'v2.86.4'
-        commit: 'sha1-a2a5f6e99e1a31540baa0468acfa302cff0f359f'
+    'taiki-e/install-action@v2.87.3':
+        ref: 'v2.87.3'
+        commit: 'sha1-0758d235715de2f3551eacc980d9ae8fce9342c3'
         owner_id: 43724913
         repo_id: 442947557
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a49bf739..12536ecd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,12 +44,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.7
+        uses: github/codeql-action/init@v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.7
+        uses: github/codeql-action/analyze@v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/mvp-smoke.yml b/.github/workflows/mvp-smoke.yml
index c8b45511..72006629 100644
--- a/.github/workflows/mvp-smoke.yml
+++ b/.github/workflows/mvp-smoke.yml
@@ -40,7 +40,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.9.2
 
       - name: Install just
-        uses: taiki-e/install-action@v2.86.4
+        uses: taiki-e/install-action@v2.87.3
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index cf06fcd5..55dff61c 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -51,4 +51,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5.0.0
+        uses: actions/deploy-pages@v5.0.1
diff --git a/.github/workflows/s4-loop.yml b/.github/workflows/s4-loop.yml
index e975e77f..0647a6d7 100644
--- a/.github/workflows/s4-loop.yml
+++ b/.github/workflows/s4-loop.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2.9.2
       - name: Install just
-        uses: taiki-e/install-action@v2.86.4
+        uses: taiki-e/install-action@v2.87.3
         with:
           tool: just@1.51.0
       - name: Install system dependencies
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 3f08f5f2..04ffdc43 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -23,6 +23,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@0d531555f4c04f086f0af58ec34e1bb27145fdbe # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@2b7202dbd5d545b0fbf79c8d43f80c3d6f4489d0 # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}