diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba71262..7087972 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,9 +18,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: nix-forge/ci/actions/setup-nix@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+      - uses: nix-forge/ci/actions/setup-nix@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
       - name: Validate workflows and template contracts
-        uses: nix-forge/ci/actions/validate-workflows@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/validate-workflows@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
   queue-completion:
     continue-on-error: true
     name: Queue completion callback
@@ -32,4 +32,4 @@ jobs:
       actions: write # Notify the trusted default-branch reconciler.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/queue-completion@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c88d218..7dcd7d6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ jobs:
       actions: read # Read workflow metadata for Actions analysis.
       contents: read
       security-events: write # Upload code scanning results.
-    uses: nix-forge/ci/.github/workflows/codeql.yml@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+    uses: nix-forge/ci/.github/workflows/codeql.yml@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
     with:
       languages: actions
   queue-completion:
@@ -37,4 +37,4 @@ jobs:
       actions: write # Dispatch trusted queue validation.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/queue-completion@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 74bd9e6..b7291e0 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -149,4 +149,4 @@ jobs:
       actions: write # Notify the trusted default-branch reconciler.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/queue-completion@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
diff --git a/.github/workflows/reconcile-merge-queue.yml b/.github/workflows/reconcile-merge-queue.yml
index 6939dad..72c4b5e 100644
--- a/.github/workflows/reconcile-merge-queue.yml
+++ b/.github/workflows/reconcile-merge-queue.yml
@@ -32,7 +32,7 @@ jobs:
       statuses: write # Report verified queue job results.
     steps:
       - name: Reconcile verified automation
-        uses: nix-forge/ci/actions/reconcile-queue@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/reconcile-queue@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
         with:
           workflows: '["ci.yml", "codeql.yml", "dco.yml"]'
           base-sha-workflows: '["dco.yml"]'
diff --git a/.github/workflows/retry-scorecard.yml b/.github/workflows/retry-scorecard.yml
index 3361df7..139c72c 100644
--- a/.github/workflows/retry-scorecard.yml
+++ b/.github/workflows/retry-scorecard.yml
@@ -13,6 +13,6 @@ jobs:
     permissions:
       actions: write # Retry only verified transient service failures.
       contents: read
-    uses: nix-forge/ci/.github/workflows/retry-scorecard.yml@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+    uses: nix-forge/ci/.github/workflows/retry-scorecard.yml@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
     with:
       source-run-id: ${{ format('{0}', github.event.workflow_run.id) }}
diff --git a/workflow-templates/dependency-review.yml b/workflow-templates/dependency-review.yml
index f3660fc..bf5a260 100644
--- a/workflow-templates/dependency-review.yml
+++ b/workflow-templates/dependency-review.yml
@@ -12,4 +12,4 @@ jobs:
     name: Dependency review
     permissions:
       contents: read
-    uses: nix-forge/ci/.github/workflows/dependency-review.yml@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+    uses: nix-forge/ci/.github/workflows/dependency-review.yml@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
diff --git a/workflow-templates/nix-checks.yml b/workflow-templates/nix-checks.yml
index 83d532a..1a259f6 100644
--- a/workflow-templates/nix-checks.yml
+++ b/workflow-templates/nix-checks.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
       - id: inventory
-        uses: nix-forge/ci/actions/discover-lockfiles@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/discover-lockfiles@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
   lock-health:
     name: Flake lock health
     needs: [lock]
@@ -45,7 +45,7 @@ jobs:
       fail-fast: false
       matrix:
         lockfile: ${{ fromJSON(needs.discover.outputs.lockfiles) }}
-    uses: nix-forge/ci/.github/workflows/flake-lock.yml@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+    uses: nix-forge/ci/.github/workflows/flake-lock.yml@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
     with:
       lockfile: ${{ matrix.lockfile }}
   checks:
@@ -58,10 +58,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: nix-forge/ci/actions/setup-nix@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+      - uses: nix-forge/ci/actions/setup-nix@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
       - name: Validate workflow contracts
-        uses: nix-forge/ci/actions/validate-workflows@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/validate-workflows@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
       - name: Materialize discovered partitions
-        uses: nix-forge/ci/actions/materialize-partitions@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+        uses: nix-forge/ci/actions/materialize-partitions@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
       - name: Run declared repository checks
         run: nix flake check --keep-going --print-build-logs
diff --git a/workflow-templates/retry-scorecard.yml b/workflow-templates/retry-scorecard.yml
index 3361df7..139c72c 100644
--- a/workflow-templates/retry-scorecard.yml
+++ b/workflow-templates/retry-scorecard.yml
@@ -13,6 +13,6 @@ jobs:
     permissions:
       actions: write # Retry only verified transient service failures.
       contents: read
-    uses: nix-forge/ci/.github/workflows/retry-scorecard.yml@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
+    uses: nix-forge/ci/.github/workflows/retry-scorecard.yml@1a6dfe0b851c69ad30169977e014bd45029e9c55 # v2.13.0
     with:
       source-run-id: ${{ format('{0}', github.event.workflow_run.id) }}