diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index cbd7467ffb7..674002d179b 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Setup Ruby
         if: env.BUILD_SITE == 'true'
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         # With ruby-version unset this reads the root .ruby-version; the bundle is docs/Gemfile.
         env:
           BUNDLE_GEMFILE: docs/Gemfile
diff --git a/.github/workflows/docs-release.yml b/.github/workflows/docs-release.yml
index 25daeb588c6..43cb6ad2b25 100644
--- a/.github/workflows/docs-release.yml
+++ b/.github/workflows/docs-release.yml
@@ -91,7 +91,7 @@ jobs:
           cache_konan: 'true'
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         # With ruby-version unset this reads the root .ruby-version; the bundle is docs/Gemfile.
         env:
           BUNDLE_GEMFILE: docs/Gemfile
diff --git a/.github/workflows/play-listing.yml b/.github/workflows/play-listing.yml
index 160b9f35535..853559d9eb6 100644
--- a/.github/workflows/play-listing.yml
+++ b/.github/workflows/play-listing.yml
@@ -44,7 +44,7 @@ jobs:
         run: python3 scripts/check-store-metadata.py
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           bundler-cache: true
 
diff --git a/.github/workflows/play-rollout.yml b/.github/workflows/play-rollout.yml
index d884cdc820c..7b43692efee 100644
--- a/.github/workflows/play-rollout.yml
+++ b/.github/workflows/play-rollout.yml
@@ -59,7 +59,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           bundler-cache: true
 
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 491eb824ad8..5b0313c0754 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -74,7 +74,7 @@ jobs:
           ref: ${{ inputs.tag_name }}
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           bundler-cache: true
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c2cac39b1b..5a9c8e928fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -479,7 +479,7 @@ jobs:
           path: ${{ runner.temp }}/google-aab
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
+        uses: ruby/setup-ruby@26e5b7d197ebf60545ee9667bcbace0be11ccaec # v1.334.0
         with:
           bundler-cache: true
 
diff --git a/.github/workflows/scheduled-updates.yml b/.github/workflows/scheduled-updates.yml
index 47e71c5a199..6ec7dad634c 100644
--- a/.github/workflows/scheduled-updates.yml
+++ b/.github/workflows/scheduled-updates.yml
@@ -162,7 +162,7 @@ jobs:
           fi
 
       - name: Sync with Crowdin
-        uses: crowdin/github-action@72955432d4aa4f6dd64cf17eeb88dd34d6ba064c # v3.4.0
+        uses: crowdin/github-action@959dc74ac104447731cba99a016f85d0ae719788 # v3.5.0
         with:
           base_url: 'https://meshtastic.crowdin.com/api/v2'
           config: 'crowdin.yml'
diff --git a/.github/workflows/verify-flatpak.yml b/.github/workflows/verify-flatpak.yml
index 6cc423d810f..859420a74ea 100644
--- a/.github/workflows/verify-flatpak.yml
+++ b/.github/workflows/verify-flatpak.yml
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           distribution: temurin
-          java-version: 25.0.4+101.0.LTS
+          java-version: 25.0.5+8.0.LTS
           token: ${{ github.token }}
 
       # JBR resolves its version list via the GitHub API — unauthenticated requests