diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ef16358..6272e907 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,7 +59,7 @@ jobs:
       # rust-cache's job-id default would have shared it by accident; naming it
       # makes that a decision, and one that survives renaming either job.
       - name: Cache cargo registry & build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: dev-check
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -170,12 +170,12 @@ jobs:
       # different profiles. rust-cache keys on the job id, so they no longer
       # collide, and this job stops handing `check` a release target it can't use.
       - name: Cache cargo registry & build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           # v9 flipped this default to false; keep the v8 behaviour so the
           # uv cache stays trimmed and does not crowd the Rust caches out.
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 941257a2..620eccc4 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -35,6 +35,6 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 006448f2..551f6fa6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,12 +30,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: none
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/examples-test.yml b/.github/workflows/examples-test.yml
index 1c0dbfef..7dab17eb 100644
--- a/.github/workflows/examples-test.yml
+++ b/.github/workflows/examples-test.yml
@@ -37,7 +37,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           # v9 flipped this default to false; keep the v8 behaviour so the
           # uv cache stays trimmed and does not crowd the Rust caches out.
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           # v9 flipped this default to false; keep the v8 behaviour so the
           # uv cache stays trimmed and does not crowd the Rust caches out.
diff --git a/.github/workflows/openapi-check.yml b/.github/workflows/openapi-check.yml
index a3c513e0..bbdd4dbf 100644
--- a/.github/workflows/openapi-check.yml
+++ b/.github/workflows/openapi-check.yml
@@ -57,7 +57,7 @@ jobs:
       # growth as there (375MB -> 730MB in 27h). The job id `openapi-drift` is
       # unique, so rust-cache's default job-scoped key is enough here.
       - name: Cache cargo registry & build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
diff --git a/.github/workflows/preflight-publish.yml b/.github/workflows/preflight-publish.yml
index 7c3a78f0..3a2910cf 100644
--- a/.github/workflows/preflight-publish.yml
+++ b/.github/workflows/preflight-publish.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           # v9 flipped this default to false; keep the v8 behaviour so the
           # uv cache stays trimmed and does not crowd the Rust caches out.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0d2b8caa..71b8c7cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -83,13 +83,13 @@ jobs:
       # save-if is false because this only ever runs on a tag ref, and tag-scoped
       # caches can never be restored by a later run — saving one is pure quota burn.
       - name: Cache cargo registry & build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: dev-check
           save-if: false
 
       - name: Install uv (for preflight scripts)
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           # v9 flipped this default to false; keep the v8 behaviour so the
           # uv cache stays trimmed and does not crowd the Rust caches out.
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 48c67187..d4561c63 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,6 +40,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
         with:
           sarif_file: results.sarif