diff --git a/.github/workflows/backup.yml b/.github/workflows/backup.yml
index 34a0de82..446347cb 100644
--- a/.github/workflows/backup.yml
+++ b/.github/workflows/backup.yml
@@ -105,7 +105,7 @@ jobs:
             --backup "${{ steps.backup.outputs.archive_path }}" \
             --target-root /tmp/agentflow-restore
       - name: Upload regression-test archive
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agentflow-backup-restore-regression-fixture
           path: ${{ steps.backup.outputs.archive_path }}
diff --git a/.github/workflows/benchmark-arm.yml b/.github/workflows/benchmark-arm.yml
index 4f6a3549..1af57376 100644
--- a/.github/workflows/benchmark-arm.yml
+++ b/.github/workflows/benchmark-arm.yml
@@ -50,7 +50,7 @@ jobs:
           --report-path .artifacts/benchmark/arm-benchmark.md
           --results-json .artifacts/benchmark/arm-current.json
       - name: Upload benchmark artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: arm-benchmark
           path: |
diff --git a/.github/workflows/cdc-production-capture.yml b/.github/workflows/cdc-production-capture.yml
index cc2bbab5..1aac587c 100644
--- a/.github/workflows/cdc-production-capture.yml
+++ b/.github/workflows/cdc-production-capture.yml
@@ -91,7 +91,7 @@ jobs:
         run: docker logs kafka-connect --tail 500 || true
       - name: Upload evidence artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: cdc-production-capture
           path: .artifacts/cdc-production/capture-evidence.md
diff --git a/.github/workflows/chaos.yml b/.github/workflows/chaos.yml
index a2f72670..291ea471 100644
--- a/.github/workflows/chaos.yml
+++ b/.github/workflows/chaos.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload chaos artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: chaos-smoke-report
           path: .artifacts/chaos/
@@ -139,7 +139,7 @@ jobs:
 
       - name: Upload chaos artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: chaos-report
           path: .artifacts/chaos/
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 26e50e90..ccba545f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -482,7 +482,7 @@ jobs:
         # general floor, which would raise the aggregate without covering
         # anything new).
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-control-plane
           path: .artifacts/coverage/coverage-control-plane.xml
@@ -504,7 +504,7 @@ jobs:
           version: v3.16.3
       - name: Report Helm version
         run: helm version --short
-      - uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0
+      - uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1
         with:
           install_only: true
       - name: Prepare pytest temp directory
@@ -633,7 +633,7 @@ jobs:
         working-directory: sdk-ts
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
       - name: Install dependencies from lockfile
@@ -671,7 +671,7 @@ jobs:
         working-directory: sdk-ts
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies from lockfile
diff --git a/.github/workflows/container-attestation.yml b/.github/workflows/container-attestation.yml
index 22c46982..3bc7cd0a 100644
--- a/.github/workflows/container-attestation.yml
+++ b/.github/workflows/container-attestation.yml
@@ -72,12 +72,12 @@ jobs:
       - name: Skip note (no container-relevant changes)
         if: steps.changes.outputs.docker == 'false'
         run: echo "No Dockerfile*/pyproject.toml/requirements.txt/workflow changes - smoke build skipped, required check passes."
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         if: steps.changes.outputs.docker == 'true'
       - name: Build API image (no push)
         if: steps.changes.outputs.docker == 'true'
         id: smoke
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: Dockerfile.api
@@ -107,11 +107,11 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push API image
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: Dockerfile.api
@@ -156,7 +156,7 @@ jobs:
             --output-dir .artifacts/image-promotion
 
       - name: Upload immutable Helm promotion evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agentflow-image-promotion-${{ github.sha }}
           path: .artifacts/image-promotion/
diff --git a/.github/workflows/dora.yml b/.github/workflows/dora.yml
index 8d4b9521..15d080d2 100644
--- a/.github/workflows/dora.yml
+++ b/.github/workflows/dora.yml
@@ -83,7 +83,7 @@ jobs:
           PY
           cat .artifacts/dora/dora-summary.md >> "$GITHUB_STEP_SUMMARY"
       - name: Upload DORA artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dora-report
           path: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index a0f0becf..37d85666 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-logs
           path: .artifacts/e2e/e2e-logs.txt
diff --git a/.github/workflows/flink-smoke.yml b/.github/workflows/flink-smoke.yml
index f1358cab..49e22388 100644
--- a/.github/workflows/flink-smoke.yml
+++ b/.github/workflows/flink-smoke.yml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Upload Flink logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: flink-smoke-logs
           path: .artifacts/flink-smoke/flink-smoke-logs.txt
diff --git a/.github/workflows/load-test.yml b/.github/workflows/load-test.yml
index 84e57846..20f09334 100644
--- a/.github/workflows/load-test.yml
+++ b/.github/workflows/load-test.yml
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upload load-test artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: load-test-results
           # Exclude the live DuckDB files: their .wal sidecar is checkpointed away
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 378edb6d..7e16ffb6 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -24,7 +24,7 @@ jobs:
         run: python scripts/mutation_report.py
       - name: Upload mutation results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutmut-results
           path: .artifacts/mutation/
diff --git a/.github/workflows/perf-regression.yml b/.github/workflows/perf-regression.yml
index 7f932b3a..a7a5ade4 100644
--- a/.github/workflows/perf-regression.yml
+++ b/.github/workflows/perf-regression.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Upload performance artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: perf-smoke-results
           path: .artifacts/perf-smoke/
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index dad1df51..627eebb3 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -32,7 +32,7 @@ jobs:
         run: python scripts/check_performance.py docs/benchmark-baseline.json .artifacts/benchmark/current.json
       - name: Upload benchmark artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: perf-baseline-results
           path: .artifacts/benchmark/
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index b229eaf7..2324703d 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6f2ba69f..aab05386 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -50,7 +50,7 @@ jobs:
           publish_results: true
 
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: .artifacts/scorecard/results.sarif
@@ -58,6 +58,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: .artifacts/scorecard/results.sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index c9792c54..02e764a1 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -364,7 +364,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "22"
       - name: Install TS SDK deps from lockfile
@@ -416,7 +416,7 @@ jobs:
           format: cyclonedx
           output: .artifacts/trivy/agentflow-api.cdx.json
       - name: Upload CycloneDX SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agentflow-api-sbom-cyclonedx
           path: .artifacts/trivy/agentflow-api.cdx.json
@@ -428,7 +428,7 @@ jobs:
           format: cyclonedx
           output: .artifacts/trivy/agentflow-flink.cdx.json
       - name: Upload Flink CycloneDX SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agentflow-flink-sbom-cyclonedx
           path: .artifacts/trivy/agentflow-flink.cdx.json
@@ -479,13 +479,13 @@ jobs:
           limit-severities-for-sarif: true
       - name: Upload Trivy API SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: .artifacts/trivy/trivy-api.sarif
           category: trivy-api-image
       - name: Upload Trivy Flink SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: .artifacts/trivy/trivy-flink.sarif
           category: trivy-flink-image
@@ -516,7 +516,7 @@ jobs:
           limit-severities-for-sarif: true
       - name: Upload Trivy IaC scan results
         if: always()
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: .artifacts/trivy/trivy-iac.sarif
           # Distinct category so these alerts do not collide with the image
diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml
index 77da1fb8..fe46bf03 100644
--- a/.github/workflows/staging-deploy.yml
+++ b/.github/workflows/staging-deploy.yml
@@ -97,7 +97,7 @@ jobs:
       - name: Prepare verification directories
         run: mkdir -p .tmp .artifacts/staging-promotion
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: agentflow-image-promotion-${{ inputs.source_sha }}
           path: .artifacts/image-promotion
@@ -155,7 +155,7 @@ jobs:
         with:
           version: v3.16.3
 
-      - uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0
+      - uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1
         with:
           cluster_name: agentflow-staging
           config: k8s/kind-config.yaml
@@ -214,7 +214,7 @@ jobs:
 
       - name: Upload staging promotion evidence
         if: ${{ success() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agentflow-staging-promotion-${{ inputs.source_sha }}-${{ github.run_id }}
           path: .artifacts/staging-promotion/
diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index 6878dc38..3e751b53 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -98,7 +98,7 @@ jobs:
             *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
           esac
 
-      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -125,7 +125,7 @@ jobs:
           mkdir -p "$GITHUB_WORKSPACE/.artifacts/terraform"
           terraform plan -var-file="${{ steps.tfvars.outputs.file }}" -out="$GITHUB_WORKSPACE/.artifacts/terraform/tfplan"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: terraform-plan-${{ inputs.environment }}
           path: .artifacts/terraform/tfplan
@@ -154,13 +154,13 @@ jobs:
             *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
           esac
 
-      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
           aws-region: ${{ vars.AWS_REGION }}
           role-session-name: gha-terraform-${{ github.run_id }}
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: terraform-plan-${{ inputs.environment }}
           path: .artifacts/terraform