diff --git a/.github/workflows/cloudflare-main.yml b/.github/workflows/cloudflare-main.yml
index 9e038a4..9de4fb0 100644
--- a/.github/workflows/cloudflare-main.yml
+++ b/.github/workflows/cloudflare-main.yml
@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -76,7 +76,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       # Under single topology the candidate and the release are the same
       # Worker, so deploying here would serve the merge immediately and there
@@ -98,7 +98,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       operation: preview
       target: release
@@ -184,7 +184,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       operation: deploy
       target: release
diff --git a/.github/workflows/cloudflare-pr.yml b/.github/workflows/cloudflare-pr.yml
index 0cf8a1c..27b6d15 100644
--- a/.github/workflows/cloudflare-pr.yml
+++ b/.github/workflows/cloudflare-pr.yml
@@ -31,7 +31,7 @@ jobs:
       github.event_name != 'pull_request' ||
       (github.event.pull_request.draft == false &&
        github.event.pull_request.head.repo.full_name == github.repository)
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -62,7 +62,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       operation: preview
       target: candidate
diff --git a/.github/workflows/cloudflare-release.yml b/.github/workflows/cloudflare-release.yml
index 2d8c332..0de4ed1 100644
--- a/.github/workflows/cloudflare-release.yml
+++ b/.github/workflows/cloudflare-release.yml
@@ -56,7 +56,7 @@ jobs:
 
   quality:
     needs: validate
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -89,7 +89,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       operation: preview
       target: release
@@ -108,7 +108,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       operation: deploy
       target: release
diff --git a/.github/workflows/npm-changesets.yml b/.github/workflows/npm-changesets.yml
index 7e77217..c5f4dfe 100644
--- a/.github/workflows/npm-changesets.yml
+++ b/.github/workflows/npm-changesets.yml
@@ -96,7 +96,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
 
@@ -236,7 +236,7 @@ jobs:
           fi
       - name: Create release pull request or publish to npm
         if: steps.freshness.outputs.stale == 'false'
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
           title: ${{ inputs.pr-title }}
           commit: ${{ inputs.pr-commit }}
diff --git a/.github/workflows/npm-main.yml b/.github/workflows/npm-main.yml
index 33ef01d..321ca87 100644
--- a/.github/workflows/npm-main.yml
+++ b/.github/workflows/npm-main.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
 
   metadata:
     needs: quality
@@ -107,7 +107,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
@@ -171,7 +171,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
diff --git a/.github/workflows/npm-pr.yml b/.github/workflows/npm-pr.yml
index 4456cf4..e824af3 100644
--- a/.github/workflows/npm-pr.yml
+++ b/.github/workflows/npm-pr.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
 
   pack:
     name: Package dry run
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index d578359..3476b16 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
 
   metadata:
     needs: quality
@@ -52,7 +52,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
diff --git a/.github/workflows/phala-deploy.yml b/.github/workflows/phala-deploy.yml
index e32daa9..785d0ce 100644
--- a/.github/workflows/phala-deploy.yml
+++ b/.github/workflows/phala-deploy.yml
@@ -47,7 +47,7 @@ jobs:
 
   quality:
     needs: policy
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@992944a4d890e517aa314204e5dceb49a42555c3 # v1.6.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@d603eb7e50827525e7325db3cc47aab3f091e701 # v1.6.0
 
   deploy:
     name: Phala ${{ inputs.target }}
@@ -137,7 +137,7 @@ jobs:
               ;;
           esac
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - name: Login to GHCR for push
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with: