diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/actions-key-smoke.yml b/.github/workflows/actions-key-smoke.yml
index d5d6680..e7e7a3c 100644
--- a/.github/workflows/actions-key-smoke.yml
+++ b/.github/workflows/actions-key-smoke.yml
@@ -57,7 +57,7 @@ jobs:
     # in seconds) -- most likely a hang in bundle install or the model call.
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run credential smoke pipeline
         id: run
@@ -118,7 +118,7 @@ jobs:
 
       - name: Upload run logs (always, for post-mortem)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: actions-key-smoke-logs
           path: ${{ steps.run.outputs.logs_dir }}
diff --git a/.github/workflows/capsule-implement.yml b/.github/workflows/capsule-implement.yml
index de0d0ef..ec76f46 100644
--- a/.github/workflows/capsule-implement.yml
+++ b/.github/workflows/capsule-implement.yml
@@ -149,7 +149,7 @@ jobs:
     timeout-minutes: 330
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
 
@@ -343,14 +343,14 @@ jobs:
           fi
           echo "engine snapshot verified: pipeline-runner project present, no .venv carried in"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         if: steps.locate.outputs.skip != 'true'
         with:
           python-version: "3.11"
 
       - name: Install uv
         if: steps.locate.outputs.skip != 'true'
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: Configure commit identity for the run
         if: steps.locate.outputs.skip != 'true'
@@ -1234,7 +1234,7 @@ jobs:
         # never ran, upload_ok != 'true' and this step is skipped --
         # fail-closed by construction.
         if: always() && steps.secret_gate.outputs.upload_ok == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: capsule-implement-issue-${{ steps.locate.outputs.issue_number }}-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/capsule-pr-probe.yml b/.github/workflows/capsule-pr-probe.yml
index a5e5aa3..8ea6277 100644
--- a/.github/workflows/capsule-pr-probe.yml
+++ b/.github/workflows/capsule-pr-probe.yml
@@ -90,7 +90,7 @@ jobs:
       matrix: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Guard -- secret must be present
         run: |
diff --git a/.github/workflows/capsule-specify.yml b/.github/workflows/capsule-specify.yml
index d41fe6b..ba23170 100644
--- a/.github/workflows/capsule-specify.yml
+++ b/.github/workflows/capsule-specify.yml
@@ -111,7 +111,7 @@ jobs:
     timeout-minutes: 360
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: "Detach the engine: snapshot pipeline-runner out of the workspace"
         # FIRES 9 (run 31760312250) AND 10 (run 31766094504) -- one mechanism.
@@ -427,12 +427,12 @@ jobs:
           echo "--- issue_file contents ---"
           cat "$issue_file"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: "Preflight: provision the critique judge's provider instance"
         id: preflight
@@ -1273,7 +1273,7 @@ jobs:
         # never ran, upload_ok != 'true' and this step is skipped --
         # fail-closed by construction.
         if: always() && steps.secret_gate.outputs.upload_ok == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: capsule-specify-issue-${{ env.ISSUE_NUMBER }}-${{ steps.base.outputs.run_id }}
           path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d81c3ee..be6e44f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,14 +49,14 @@ jobs:
           - name: tool-report-outcome
             extra_args: ""
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: Install dependencies
         working-directory: modules/${{ matrix.module.name }}
@@ -99,7 +99,7 @@ jobs:
     name: DOT Render Gate (every tracked .dot renders)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install graphviz
         run: |
@@ -177,14 +177,14 @@ jobs:
     name: Opinionated Guards (repo root)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: Install graphviz
         run: |
diff --git a/.github/workflows/feature-specify.yml b/.github/workflows/feature-specify.yml
index 905c295..b5454e1 100644
--- a/.github/workflows/feature-specify.yml
+++ b/.github/workflows/feature-specify.yml
@@ -148,7 +148,7 @@ jobs:
     timeout-minutes: 250
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           # 60, not the default 1 and not 0 (full history). The
           # discrimination check below needs a real, unrelated commit to
@@ -598,14 +598,14 @@ jobs:
           echo "--- criteria_file contents ---"
           cat "$criteria_file"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         if: steps.idem.outputs.skip != 'true'
         with:
           python-version: "3.11"
 
       - name: Install uv
         if: steps.idem.outputs.skip != 'true'
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: "Preflight: provision the critique judge's provider instance"
         id: preflight
@@ -1648,7 +1648,7 @@ jobs:
         # ran, upload_ok != 'true' and this step is skipped -- fail-closed by
         # construction.
         if: always() && steps.idem.outputs.skip != 'true' && steps.secret_gate.outputs.upload_ok == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: feature-specify-issue-${{ env.ISSUE_NUMBER }}-${{ steps.base.outputs.run_id }}
           path: |