diff --git a/.github/workflows/acp-freshness.yml b/.github/workflows/acp-freshness.yml
index a375ced34a..0266fe6991 100644
--- a/.github/workflows/acp-freshness.yml
+++ b/.github/workflows/acp-freshness.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install: false
           cache: false
diff --git a/.github/workflows/canary-container-images.yml b/.github/workflows/canary-container-images.yml
index 4a8095e601..b04bcc50aa 100644
--- a/.github/workflows/canary-container-images.yml
+++ b/.github/workflows/canary-container-images.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install: false
           cache: false
@@ -50,7 +50,7 @@ jobs:
         run: mise run --skip-tools github-actions:resolve-image
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -85,7 +85,7 @@ jobs:
           exit-code: 0
 
       - name: Generate SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ steps.image.outputs.name }}@${{ steps.build_image.outputs.digest }}
           artifact-name: sbom-${{ matrix.service }}-spdx
diff --git a/.github/workflows/ci-adr.yml b/.github/workflows/ci-adr.yml
index 41dc0993e7..0d2047db88 100644
--- a/.github/workflows/ci-adr.yml
+++ b/.github/workflows/ci-adr.yml
@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install: false
 
diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml
index 6141ae0944..c4cb2ab203 100644
--- a/.github/workflows/ci-docs.yml
+++ b/.github/workflows/ci-docs.yml
@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: docs/package.json
 
diff --git a/.github/workflows/ci-go.yml b/.github/workflows/ci-go.yml
index f128c89b1e..9cf22d7038 100644
--- a/.github/workflows/ci-go.yml
+++ b/.github/workflows/ci-go.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Go tooling via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: go buf rust cargo:wasm-tools
 
diff --git a/.github/workflows/ci-proto.yml b/.github/workflows/ci-proto.yml
index 4bcbf55114..1b4d61a768 100644
--- a/.github/workflows/ci-proto.yml
+++ b/.github/workflows/ci-proto.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: buf
 
@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: buf
 
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: buf
 
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Install buf via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: buf
 
@@ -104,7 +104,7 @@ jobs:
           persist-credentials: false
 
       - name: Install proto codegen toolchain via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: buf rust cargo:protoc-gen-buffa cargo:protoc-gen-buffa-packaging
 
diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index 5a3b02efda..be7df88816 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -50,7 +50,7 @@ jobs:
         run: mise run --skip-tools rust:tls-policy
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: rsworkspace -> target
           save-if: true
@@ -89,7 +89,7 @@ jobs:
         uses: ./.github/actions/setup-rust
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: rsworkspace -> target
           save-if: true
@@ -97,7 +97,7 @@ jobs:
           cache-workspace-crates: true
 
       - name: Install coverage tools
-        uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4
+        uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2.87.1
         with:
           tool: cargo-llvm-cov,nextest
 
@@ -142,7 +142,7 @@ jobs:
         uses: ./.github/actions/setup-rust
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: rsworkspace -> target
           save-if: true
@@ -167,7 +167,7 @@ jobs:
         uses: ./.github/actions/setup-rust
 
       - name: Cache dependencies
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: rsworkspace -> target
           save-if: always
diff --git a/.github/workflows/ci-semconv.yml b/.github/workflows/ci-semconv.yml
index 49fae5d3b4..8a35a5b213 100644
--- a/.github/workflows/ci-semconv.yml
+++ b/.github/workflows/ci-semconv.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Weaver via mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install_args: ubi:open-telemetry/weaver
 
diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index 9ba6fe93b2..77dcfbce4c 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: tsworkspace/package.json
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6928e93f65..a1f33e14cc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,13 +40,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-and-quality
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml
index 7bb4645e1d..b699780174 100644
--- a/.github/workflows/docs-pages.yml
+++ b/.github/workflows/docs-pages.yml
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: docs/package.json
 
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 172e2580c4..f6e1f63747 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -39,7 +39,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           cache: false
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Install cross
         if: ${{ matrix.use-cross }}
-        uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4
+        uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2.87.1
         with:
           tool: cross
 
@@ -73,7 +73,7 @@ jobs:
         run: mise run github-actions:package-release-binary
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: ${{ env.ASSET }}
 
@@ -96,7 +96,7 @@ jobs:
           persist-credentials: false
 
       - name: Install mise
-        uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           install: false
           cache: false