diff --git a/.github/workflows/also-deployed-by.yml b/.github/workflows/also-deployed-by.yml
index 7776afd..239d456 100644
--- a/.github/workflows/also-deployed-by.yml
+++ b/.github/workflows/also-deployed-by.yml
@@ -72,7 +72,7 @@ jobs:
           token: ${{ secrets.CONTENT_BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -386,7 +386,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/apply-setup.yml b/.github/workflows/apply-setup.yml
index addf8cb..d132694 100644
--- a/.github/workflows/apply-setup.yml
+++ b/.github/workflows/apply-setup.yml
@@ -63,7 +63,7 @@ jobs:
           token: ${{ secrets.CONTENT_BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cdf036f..f8d4b17 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: needs.changes.outputs.content_only != 'true'
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: none
@@ -61,7 +61,7 @@ jobs:
 
       - name: Analyze repository
         if: needs.changes.outputs.content_only != 'true'
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:${{ matrix.language }}
 
diff --git a/.github/workflows/content-only.yml b/.github/workflows/content-only.yml
index 9293714..b535714 100644
--- a/.github/workflows/content-only.yml
+++ b/.github/workflows/content-only.yml
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/edit-request.yml b/.github/workflows/edit-request.yml
index e7c9d37..dfa28c3 100644
--- a/.github/workflows/edit-request.yml
+++ b/.github/workflows/edit-request.yml
@@ -70,7 +70,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/metrics.yml b/.github/workflows/metrics.yml
index f1b0858..d0ca638 100644
--- a/.github/workflows/metrics.yml
+++ b/.github/workflows/metrics.yml
@@ -71,7 +71,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/missing-label.yml b/.github/workflows/missing-label.yml
index a36575e..6c4f997 100644
--- a/.github/workflows/missing-label.yml
+++ b/.github/workflows/missing-label.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/new-entry.yml b/.github/workflows/new-entry.yml
index 5d47fc0..c5c1712 100644
--- a/.github/workflows/new-entry.yml
+++ b/.github/workflows/new-entry.yml
@@ -85,7 +85,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -136,7 +136,7 @@ jobs:
           token: ${{ secrets.CONTENT_BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -551,7 +551,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/new-event.yml b/.github/workflows/new-event.yml
index f933c9e..027c01d 100644
--- a/.github/workflows/new-event.yml
+++ b/.github/workflows/new-event.yml
@@ -48,7 +48,7 @@ jobs:
           token: ${{ secrets.CONTENT_BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
 
diff --git a/.github/workflows/new-year.yml b/.github/workflows/new-year.yml
index 924086c..a14a9bd 100644
--- a/.github/workflows/new-year.yml
+++ b/.github/workflows/new-year.yml
@@ -54,7 +54,7 @@ jobs:
           token: ${{ secrets.CONTENT_BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -82,7 +82,7 @@ jobs:
           ISSUE_BODY: ${{ github.event.issue.body }}
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
 
       - name: Resolve the year
         id: year
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index eb3d708..45d0237 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -56,7 +56,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -152,12 +152,12 @@ jobs:
           ref: ${{ github.sha }}
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
 
@@ -296,7 +296,7 @@ jobs:
           echo "value=$(ruby -ryaml -e 'puts((YAML.load_file("_data/schema.yml")["entry"] || {})["path"] || "catalog")')" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index 0d4a051..16cfab7 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -51,12 +51,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby from .ruby-version
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node from .node-version
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -103,7 +103,7 @@ jobs:
 
       - name: Upload scale evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: performance-${{ github.sha }}
           path: performance-report.json
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 700fec7..ac9adb1 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -56,12 +56,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -219,7 +219,7 @@ jobs:
 
       - name: Upload the reports
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: quality-reports
           path: ${{ runner.temp }}/quality
diff --git a/.github/workflows/refresh-entry.yml b/.github/workflows/refresh-entry.yml
index ee58e10..ae3d175 100644
--- a/.github/workflows/refresh-entry.yml
+++ b/.github/workflows/refresh-entry.yml
@@ -70,7 +70,7 @@ jobs:
           token: ${{ secrets.CONTENT_BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -414,7 +414,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/security-signals.yml b/.github/workflows/security-signals.yml
index 7dec73b..9beecbd 100644
--- a/.github/workflows/security-signals.yml
+++ b/.github/workflows/security-signals.yml
@@ -81,7 +81,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index d32ce40..7ea76ec 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -19,12 +19,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
 
diff --git a/.github/workflows/submission-status.yml b/.github/workflows/submission-status.yml
index 9da152d..95d0e18 100644
--- a/.github/workflows/submission-status.yml
+++ b/.github/workflows/submission-status.yml
@@ -109,7 +109,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 5c506fc..dcfea97 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -40,12 +40,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby from .ruby-version
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node from .node-version
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -69,7 +69,7 @@ jobs:
         run: npm run sbom -- --output sbom.cdx.json
 
       - name: Upload SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom-${{ github.sha }}
           path: sbom.cdx.json
diff --git a/.github/workflows/thumbnails.yml b/.github/workflows/thumbnails.yml
index 6f3b03c..49e581b 100644
--- a/.github/workflows/thumbnails.yml
+++ b/.github/workflows/thumbnails.yml
@@ -62,7 +62,7 @@ jobs:
           # zizmor: ignore[artipacked]
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/update-event-attachments.yml b/.github/workflows/update-event-attachments.yml
index 57b639e..1869b12 100644
--- a/.github/workflows/update-event-attachments.yml
+++ b/.github/workflows/update-event-attachments.yml
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
 
diff --git a/.github/workflows/update-phct.yml b/.github/workflows/update-phct.yml
index b114f3c..58b6f45 100644
--- a/.github/workflows/update-phct.yml
+++ b/.github/workflows/update-phct.yml
@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node from .node-version
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -238,12 +238,12 @@ jobs:
       # the job belongs to the currently consumed downstream version and only
       # runs the bootstrap checks; select both candidate versions after reconciling the parent tree.
       - name: Setup candidate Ruby from the applied .ruby-version
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup candidate Node from the applied .node-version
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -320,7 +320,7 @@ jobs:
 
       - name: Save the inspectable site and ownership evidence
         if: steps.candidate.outputs.up_to_date != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: phct-update-${{ steps.release.outputs.release }}
           path: |
@@ -333,7 +333,7 @@ jobs:
       - name: Transfer the verified commit to an isolated publication job
         id: publication
         if: steps.candidate.outputs.up_to_date != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: phct-publication-${{ steps.release.outputs.release }}
           path: ${{ runner.temp }}/phct-update.bundle
@@ -364,7 +364,7 @@ jobs:
           persist-credentials: false
 
       - name: Download the verified publication bundle
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: phct-publication-${{ needs.update.outputs.release }}
           path: ${{ runner.temp }}/phct-publication
diff --git a/.github/workflows/update-schedule.yml b/.github/workflows/update-schedule.yml
index d6078b3..89df645 100644
--- a/.github/workflows/update-schedule.yml
+++ b/.github/workflows/update-schedule.yml
@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -66,7 +66,7 @@ jobs:
             await notify.notifyIssue({ github, context, core, status: notify.STATUS.received });
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
 
       - name: Preview normalized event IDs
         id: preview
diff --git a/.github/workflows/uploads-cleanup.yml b/.github/workflows/uploads-cleanup.yml
index 2889c85..cc4ff33 100644
--- a/.github/workflows/uploads-cleanup.yml
+++ b/.github/workflows/uploads-cleanup.yml
@@ -85,7 +85,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 6a77dab..3255c67 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -55,12 +55,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -104,12 +104,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -173,12 +173,12 @@ jobs:
           persist-credentials: false
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
@@ -210,13 +210,13 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           bundler-cache: true
 
@@ -231,7 +231,7 @@ jobs:
 
       - name: Upload coverage evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-${{ github.sha }}
           path: coverage/
diff --git a/.github/workflows/verification-sweep.yml b/.github/workflows/verification-sweep.yml
index 9b4b042..54dfb27 100644
--- a/.github/workflows/verification-sweep.yml
+++ b/.github/workflows/verification-sweep.yml
@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ".node-version"
           cache: npm