diff --git a/.github/workflows/cloudflare-main.yml b/.github/workflows/cloudflare-main.yml
index 44f00dd..d034dc5 100644
--- a/.github/workflows/cloudflare-main.yml
+++ b/.github/workflows/cloudflare-main.yml
@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -76,7 +76,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       # Under single topology the candidate and the release are the same
       # Worker, so deploying here would serve the merge immediately and there
@@ -98,7 +98,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       operation: preview
       target: release
@@ -184,7 +184,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       operation: deploy
       target: release
diff --git a/.github/workflows/cloudflare-pr.yml b/.github/workflows/cloudflare-pr.yml
index 1b1a2f8..541de4d 100644
--- a/.github/workflows/cloudflare-pr.yml
+++ b/.github/workflows/cloudflare-pr.yml
@@ -31,7 +31,7 @@ jobs:
       github.event_name != 'pull_request' ||
       (github.event.pull_request.draft == false &&
        github.event.pull_request.head.repo.full_name == github.repository)
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -62,7 +62,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       operation: preview
       target: candidate
diff --git a/.github/workflows/cloudflare-release.yml b/.github/workflows/cloudflare-release.yml
index 9d1b63c..7d20127 100644
--- a/.github/workflows/cloudflare-release.yml
+++ b/.github/workflows/cloudflare-release.yml
@@ -56,7 +56,7 @@ jobs:
 
   quality:
     needs: validate
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -89,7 +89,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       operation: preview
       target: release
@@ -108,7 +108,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       operation: deploy
       target: release
diff --git a/.github/workflows/cloudflare-version.yml b/.github/workflows/cloudflare-version.yml
index b528fe7..8ca313a 100644
--- a/.github/workflows/cloudflare-version.yml
+++ b/.github/workflows/cloudflare-version.yml
@@ -146,7 +146,7 @@ jobs:
         # The same pinned action as the deploy below, for the same reason the
         # secrets step uses it: wrangler out of the consumer's node_modules
         # would put a caller-resolved binary next to the deployment credential.
-        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
+        uses: cloudflare/wrangler-action@25853364521e0d392ece9b0c1e97a4b37b638087 # v4.1.2
         with:
           apiToken: ${{ secrets.cloudflare-api-token || secrets.BURNT_CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.cloudflare-account-id || secrets.BURNT_CLOUDFLARE_ACCOUNT_ID }}
@@ -200,7 +200,7 @@ jobs:
         # binary next to the deployment credential, and would also fail outright
         # for a consumer that lets this action supply wrangler rather than
         # depending on it directly.
-        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
+        uses: cloudflare/wrangler-action@25853364521e0d392ece9b0c1e97a4b37b638087 # v4.1.2
         with:
           apiToken: ${{ secrets.cloudflare-api-token || secrets.BURNT_CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.cloudflare-account-id || secrets.BURNT_CLOUDFLARE_ACCOUNT_ID }}
@@ -215,7 +215,7 @@ jobs:
             ${{ fromJSON(inputs.deployment-policy).topology != 'single' && format('--env {0}', fromJSON(inputs.deployment-policy).targets[inputs.target].wranglerEnv) || '' }}
       - name: Upload or deploy Worker version
         id: wrangler
-        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
+        uses: cloudflare/wrangler-action@25853364521e0d392ece9b0c1e97a4b37b638087 # v4.1.2
         with:
           apiToken: ${{ secrets.cloudflare-api-token || secrets.BURNT_CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.cloudflare-account-id || secrets.BURNT_CLOUDFLARE_ACCOUNT_ID }}
diff --git a/.github/workflows/npm-changesets.yml b/.github/workflows/npm-changesets.yml
index c708188..f75c457 100644
--- a/.github/workflows/npm-changesets.yml
+++ b/.github/workflows/npm-changesets.yml
@@ -96,7 +96,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
 
@@ -236,7 +236,7 @@ jobs:
           fi
       - name: Create release pull request or publish to npm
         if: steps.freshness.outputs.stale == 'false'
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
           title: ${{ inputs.pr-title }}
           commit: ${{ inputs.pr-commit }}
diff --git a/.github/workflows/npm-main.yml b/.github/workflows/npm-main.yml
index 892f0b3..afe5e17 100644
--- a/.github/workflows/npm-main.yml
+++ b/.github/workflows/npm-main.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
 
   metadata:
     needs: quality
@@ -107,7 +107,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
@@ -171,7 +171,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
diff --git a/.github/workflows/npm-pr.yml b/.github/workflows/npm-pr.yml
index d7312ae..70c3572 100644
--- a/.github/workflows/npm-pr.yml
+++ b/.github/workflows/npm-pr.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
 
   pack:
     name: Package dry run
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index ccf3a6c..70efa21 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
 
   metadata:
     needs: quality
@@ -52,7 +52,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
diff --git a/.github/workflows/phala-deploy.yml b/.github/workflows/phala-deploy.yml
index 52d3ace..9630286 100644
--- a/.github/workflows/phala-deploy.yml
+++ b/.github/workflows/phala-deploy.yml
@@ -47,7 +47,7 @@ jobs:
 
   quality:
     needs: policy
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@3332fc8e0049b837e851778cb1fb2be1f24acb1a # v1.7.0
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@77f180ebd9f1d11cbaaf135e24f769b98c6d3601 # v1.7.0
 
   deploy:
     name: Phala ${{ inputs.target }}
@@ -137,7 +137,7 @@ jobs:
               ;;
           esac
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: Login to GHCR for push
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
@@ -146,7 +146,7 @@ jobs:
           password: ${{ github.token }}
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ fromJSON(needs.policy.outputs.phala).image.context }}
           file: ${{ fromJSON(needs.policy.outputs.phala).image.dockerfile }}