diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 104d819..b17b783 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -57,4 +57,4 @@ jobs:
       contents: read
       id-token: write
     # SHA-pinned, per org policy — never a branch. The broker door pins this SHA too.
-    uses: bounded-systems/.github/.github/workflows/_auto-merge.yml@a0330aea1a9fc899ff1002bf52d20ef8d9b2edad
+    uses: bounded-systems/.github/.github/workflows/_auto-merge.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml
index 0f44b16..d5a73e8 100644
--- a/.github/workflows/claim-sweep.yml
+++ b/.github/workflows/claim-sweep.yml
@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@953ed46c6560abe5366fbcf1235023dc46192776
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 271e320..af193be 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -43,4 +43,4 @@ jobs:
   osv:
     # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a
     # reviewer can tell an intentional bump from a drifted one.
-    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@ce6310f52e47fcd3f536bfd267edc62974ecfc9f # main
+    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@752eb5ca508e4bdcb895ae4f4f2b423ff0726c7b # main
diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml
index 70dee97..a483bda 100644
--- a/.github/workflows/front-desk-add.yml
+++ b/.github/workflows/front-desk-add.yml
@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@953ed46c6560abe5366fbcf1235023dc46192776 # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}
diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml
index 871c69f..cebf7e0 100644
--- a/.github/workflows/pr-claim.yml
+++ b/.github/workflows/pr-claim.yml
@@ -81,4 +81,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@bc4cb7dada47cc59eed416372a4851201bd6f503
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8e6a701..b786cb1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,7 +47,7 @@ jobs:
             trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
             
       - name: Setup Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17
         with:
           name: hooksmith
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -220,7 +220,7 @@ jobs:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
           
       - name: Setup Cachix
-        uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17
         with:
           name: hooksmith
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -295,7 +295,7 @@ jobs:
           EOF
           
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           files: release-final/*
diff --git a/.github/workflows/standard.yml b/.github/workflows/standard.yml
index 5509276..54501fb 100644
--- a/.github/workflows/standard.yml
+++ b/.github/workflows/standard.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   standard:
-    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@953ed46c6560abe5366fbcf1235023dc46192776
+    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
     with:
       security: true
       test: true