diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64f932c..12236ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
       # The toolchain comes from rust-toolchain.toml, which rustup installs on
       # first use, so no setup action decides the version.
       - run: cargo fmt --all --check
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e8fc6dc..524d60e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
       # The manifest is generated from the binary, so a rule added, renamed or
       # withdrawn without regenerating it fails here rather than reaching the
       # website.
@@ -50,7 +50,7 @@ jobs:
       # rule that does not exist, and no page quotes a stale default.
       - run: bun test
         working-directory: site
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v6.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v6.0.0
         with:
           python-version: "3.12"
       - run: pip install --quiet pillow
diff --git a/.github/workflows/fleet-lint.yml b/.github/workflows/fleet-lint.yml
index b76a4ec..f64038d 100644
--- a/.github/workflows/fleet-lint.yml
+++ b/.github/workflows/fleet-lint.yml
@@ -88,7 +88,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # High severity gates; everything else is visible in the job log. Tighten
       # per repository once the backlog is clear.
-      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+      - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           min-severity: high
           advanced-security: false
@@ -241,7 +241,7 @@ jobs:
           echo "count=${count}" >> "$GITHUB_OUTPUT"
       # Heavy — it drives the compiler over the whole workspace — so the cache
       # earns its place, but only where the job will actually build.
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         if: steps.bins.outputs.count != '0'
       - name: Install hawk
         if: steps.bins.outputs.count != '0'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c970ec9..98f923e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -210,7 +210,7 @@ jobs:
       # published this way, because crates.io will not attach a trusted
       # publisher to a crate that does not exist yet. Delete the secret once
       # the trusted publisher is configured and this step takes over again.
-      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
         id: auth
         if: env.HAS_STORED_TOKEN == 'false'
       - name: Publish