diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7ef7e8..c99d7b6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Install uv
         # Full version pin required: astral-sh/setup-uv publishes no floating
         # major tag (`@v8` fails to resolve). Dependabot walks the pin forward.
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
         with:
           version: "latest"
       - name: Pin Python
@@ -52,4 +52,4 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@b10a24c576f8210635f00f5e5fd7a27c614409a9 # ci-v3.2.1
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2d5f772..1b8ef14 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -38,7 +38,7 @@ jobs:
   dependency-audit:
     permissions:
       contents: read
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@b10a24c576f8210635f00f5e5fd7a27c614409a9 # ci-v3.2.1
     with:
       run-python-audit: true
 
@@ -134,7 +134,7 @@ jobs:
         run: gitleaks detect --redact --no-banner --source . --log-opts="--all"
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
+        uses: hseshadr/ci/.github/actions/setup-python-uv@b10a24c576f8210635f00f5e5fd7a27c614409a9 # ci-v3.2.1
         with:
           sync-args: "--frozen --all-extras"
 
@@ -222,7 +222,7 @@ jobs:
         run: sha256sum dist/* > SHA256SUMS
 
       - name: Upload verified release artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: edge-proc-${{ github.sha }}
           path: |
@@ -240,7 +240,7 @@ jobs:
       contents: read
     steps:
       - name: Download verified release artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: edge-proc-${{ github.sha }}
           path: release
@@ -318,7 +318,7 @@ jobs:
       contents: read
     steps:
       - name: Download verified release artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: edge-proc-${{ github.sha }}
           path: release
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 4e49ee8..11ee4b1 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -27,7 +27,7 @@ jobs:
 
       - name: Install uv
         # No floating v8 tag exists for setup-uv — full version pin required.
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
         with:
           version: "latest"