diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0a59725..af1154b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,15 +45,15 @@ jobs:
         language: [javascript-typescript]
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: none
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/e2e-scorecard-contract.yml b/.github/workflows/e2e-scorecard-contract.yml
index f36c703..95ea285 100644
--- a/.github/workflows/e2e-scorecard-contract.yml
+++ b/.github/workflows/e2e-scorecard-contract.yml
@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d68d1d9..cd1d50e 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -43,7 +43,7 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -104,7 +104,7 @@ jobs:
       # persist-credentials:false — belt for the read job too: keep even the read-scoped token out
       # of .git/config so npm-ci lifecycle scripts can't read it. The real defence is that this job
       # has ONLY contents:read; the WRITE token lives exclusively on publish-stats below.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -157,7 +157,7 @@ jobs:
       # Runs under contents:read — even if this third-party action pulls github.token via its own
       # manifest default, the token is read-scoped and cannot push (the whole point of the split).
       - name: Emit stats.json
-        uses: neckarshore-ai/test-stats-action@54ae407769bdfea6b8fed2672f0ceefa5ef2588a
+        uses: neckarshore-ai/test-stats-action@eff3ddbc9e7d9b68db38f451d0395681ff8df592
         with:
           repo: ${{ github.repository }}
           out: stats.json
@@ -227,7 +227,7 @@ jobs:
       # ONLY on the final `git push` via http.extraheader below. The interim reads (git fetch/show
       # of origin/stats-data) are anonymous over https — trustscope is PUBLIC, so read needs no
       # credential; only the push does.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/jsx-whitespace-guard.yml b/.github/workflows/jsx-whitespace-guard.yml
index bef6f3d..3485515 100644
--- a/.github/workflows/jsx-whitespace-guard.yml
+++ b/.github/workflows/jsx-whitespace-guard.yml
@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 04ba1e7..d9c0b98 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/three-pillar-guard.yml b/.github/workflows/three-pillar-guard.yml
index 0242897..c9d81ef 100644
--- a/.github/workflows/three-pillar-guard.yml
+++ b/.github/workflows/three-pillar-guard.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/token-health.yml b/.github/workflows/token-health.yml
index c57c4af..b1ad584 100644
--- a/.github/workflows/token-health.yml
+++ b/.github/workflows/token-health.yml
@@ -27,7 +27,7 @@ jobs:
       HEALTH_MARKER: "<!-- token-health:health-fail -->"
       RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 0b65d7c..63b8296 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
index 947c164..0d8720b 100644
--- a/.github/workflows/unit.yml
+++ b/.github/workflows/unit.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false