diff --git a/.github/workflows/actions-key-smoke.yml b/.github/workflows/actions-key-smoke.yml
index e7e7a3c..51947ae 100644
--- a/.github/workflows/actions-key-smoke.yml
+++ b/.github/workflows/actions-key-smoke.yml
@@ -57,7 +57,7 @@ jobs:
     # in seconds) -- most likely a hang in bundle install or the model call.
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run credential smoke pipeline
         id: run
@@ -118,7 +118,7 @@ jobs:
 
       - name: Upload run logs (always, for post-mortem)
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: actions-key-smoke-logs
           path: ${{ steps.run.outputs.logs_dir }}
diff --git a/.github/workflows/capsule-implement.yml b/.github/workflows/capsule-implement.yml
index ec76f46..85c17fc 100644
--- a/.github/workflows/capsule-implement.yml
+++ b/.github/workflows/capsule-implement.yml
@@ -149,7 +149,7 @@ jobs:
     timeout-minutes: 330
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
@@ -343,14 +343,14 @@ jobs:
           fi
           echo "engine snapshot verified: pipeline-runner project present, no .venv carried in"
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: steps.locate.outputs.skip != 'true'
         with:
           python-version: "3.11"
 
       - name: Install uv
         if: steps.locate.outputs.skip != 'true'
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Configure commit identity for the run
         if: steps.locate.outputs.skip != 'true'
@@ -1234,7 +1234,7 @@ jobs:
         # never ran, upload_ok != 'true' and this step is skipped --
         # fail-closed by construction.
         if: always() && steps.secret_gate.outputs.upload_ok == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: capsule-implement-issue-${{ steps.locate.outputs.issue_number }}-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/capsule-pr-probe.yml b/.github/workflows/capsule-pr-probe.yml
index 8ea6277..8f6146e 100644
--- a/.github/workflows/capsule-pr-probe.yml
+++ b/.github/workflows/capsule-pr-probe.yml
@@ -90,7 +90,7 @@ jobs:
       matrix: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Guard -- secret must be present
         run: |
diff --git a/.github/workflows/capsule-specify.yml b/.github/workflows/capsule-specify.yml
index ba23170..9803df2 100644
--- a/.github/workflows/capsule-specify.yml
+++ b/.github/workflows/capsule-specify.yml
@@ -111,7 +111,7 @@ jobs:
     timeout-minutes: 360
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Detach the engine: snapshot pipeline-runner out of the workspace"
         # FIRES 9 (run 31760312250) AND 10 (run 31766094504) -- one mechanism.
@@ -427,12 +427,12 @@ jobs:
           echo "--- issue_file contents ---"
           cat "$issue_file"
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: "Preflight: provision the critique judge's provider instance"
         id: preflight
@@ -1273,7 +1273,7 @@ jobs:
         # never ran, upload_ok != 'true' and this step is skipped --
         # fail-closed by construction.
         if: always() && steps.secret_gate.outputs.upload_ok == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: capsule-specify-issue-${{ env.ISSUE_NUMBER }}-${{ steps.base.outputs.run_id }}
           path: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be6e44f..8173b7d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,14 +49,14 @@ jobs:
           - name: tool-report-outcome
             extra_args: ""
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Install dependencies
         working-directory: modules/${{ matrix.module.name }}
@@ -99,7 +99,7 @@ jobs:
     name: DOT Render Gate (every tracked .dot renders)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install graphviz
         run: |
@@ -177,14 +177,14 @@ jobs:
     name: Opinionated Guards (repo root)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: Install graphviz
         run: |
diff --git a/.github/workflows/feature-specify.yml b/.github/workflows/feature-specify.yml
index b5454e1..1b6089c 100644
--- a/.github/workflows/feature-specify.yml
+++ b/.github/workflows/feature-specify.yml
@@ -148,7 +148,7 @@ jobs:
     timeout-minutes: 250
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # 60, not the default 1 and not 0 (full history). The
           # discrimination check below needs a real, unrelated commit to
@@ -598,14 +598,14 @@ jobs:
           echo "--- criteria_file contents ---"
           cat "$criteria_file"
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: steps.idem.outputs.skip != 'true'
         with:
           python-version: "3.11"
 
       - name: Install uv
         if: steps.idem.outputs.skip != 'true'
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
 
       - name: "Preflight: provision the critique judge's provider instance"
         id: preflight
@@ -1648,7 +1648,7 @@ jobs:
         # ran, upload_ok != 'true' and this step is skipped -- fail-closed by
         # construction.
         if: always() && steps.idem.outputs.skip != 'true' && steps.secret_gate.outputs.upload_ok == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: feature-specify-issue-${{ env.ISSUE_NUMBER }}-${{ steps.base.outputs.run_id }}
           path: |