diff --git a/.github/workflows/graphs.yml b/.github/workflows/graphs.yml
index 66fba8ed9..3efd6729a 100644
--- a/.github/workflows/graphs.yml
+++ b/.github/workflows/graphs.yml
@@ -1,18 +1,10 @@
 #
-# ===============================
-# Do not edit this file directly!
-# ===============================
+# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then
+# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are
+# passed to them, and the token gets only the permissions it needs.
+# Update Template CI and the template step of Setup CI are off, so these
+# edits are not overwritten. Change sites in .upptimerc.yml as usual.
 #
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.41.0
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
 
 name: Graphs CI
 on:
@@ -21,18 +13,20 @@ on:
   repository_dispatch:
     types: [graphs]
   workflow_dispatch:
+permissions:
+  contents: write
 jobs:
   release:
     name: Generate graphs
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT || github.token }}
       - name: Generate graphs
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "graphs"
         env:
diff --git a/.github/workflows/response-time.yml b/.github/workflows/response-time.yml
index 8427aa61e..2d91ce0f2 100644
--- a/.github/workflows/response-time.yml
+++ b/.github/workflows/response-time.yml
@@ -1,18 +1,10 @@
 #
-# ===============================
-# Do not edit this file directly!
-# ===============================
+# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then
+# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are
+# passed to them, and the token gets only the permissions it needs.
+# Update Template CI and the template step of Setup CI are off, so these
+# edits are not overwritten. Change sites in .upptimerc.yml as usual.
 #
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.41.0
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
 
 name: Response Time CI
 on:
@@ -21,20 +13,22 @@ on:
   repository_dispatch:
     types: [response_time]
   workflow_dispatch:
+permissions:
+  contents: write
+  issues: write
 jobs:
   release:
     name: Check status
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT || github.token }}
       - name: Update response time
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "response-time"
         env:
           GH_PAT: ${{ secrets.GH_PAT || github.token }}
-          SECRETS_CONTEXT: ${{ toJson(secrets) }}
diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml
index 237ebdf36..b309cfca6 100644
--- a/.github/workflows/setup.yml
+++ b/.github/workflows/setup.yml
@@ -1,68 +1,59 @@
 #
-# ===============================
-# Do not edit this file directly!
-# ===============================
+# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then
+# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are
+# passed to them, and the token gets only the permissions it needs.
+# The "update-template" step is removed: it regenerated these workflows from
+# the upstream template and would undo the hardening. Change sites in
+# .upptimerc.yml as usual; this workflow then refreshes the README and site.
 #
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.41.0
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
 
 name: Setup CI
 on:
   push:
+    branches: [master]
     paths:
       - ".upptimerc.yml"
   repository_dispatch:
     types: [setup]
   workflow_dispatch:
+permissions:
+  contents: write
+  actions: write
+  issues: write
 jobs:
   release:
     name: Setup Upptime
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT || github.token }}
-      - name: Update template
-        uses: upptime/uptime-monitor@v1.41.0
-        with:
-          command: "update-template"
-        env:
-          GH_PAT: ${{ secrets.GH_PAT || github.token }}
       - name: Update response time
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "response-time"
         env:
           GH_PAT: ${{ secrets.GH_PAT || github.token }}
-          SECRETS_CONTEXT: ${{ toJson(secrets) }}
       - name: Update summary in README
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "readme"
         env:
           GH_PAT: ${{ secrets.GH_PAT || github.token }}
       - name: Generate graphs
-        uses: benc-uk/workflow-dispatch@v1
+        uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1
         with:
           workflow: Graphs CI
           token: ${{ secrets.GH_PAT || github.token }}
       - name: Generate site
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "site"
         env:
           GH_PAT: ${{ secrets.GH_PAT || github.token }}
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4
         name: GitHub Pages Deploy
         with:
           github_token: ${{ secrets.GH_PAT || github.token }}
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index ed220474e..b08f884ca 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -1,18 +1,10 @@
 #
-# ===============================
-# Do not edit this file directly!
-# ===============================
+# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then
+# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are
+# passed to them, and the token gets only the permissions it needs.
+# Update Template CI and the template step of Setup CI are off, so these
+# edits are not overwritten. Change sites in .upptimerc.yml as usual.
 #
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.41.0
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
 
 name: Static Site CI
 on:
@@ -21,6 +13,8 @@ on:
   repository_dispatch:
     types: [static_site]
   workflow_dispatch:
+permissions:
+  contents: write
 jobs:
   release:
     name: Build and deploy site
@@ -28,17 +22,17 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT || github.token }}
       - name: Generate site
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "site"
         env:
           GH_PAT: ${{ secrets.GH_PAT || github.token }}
-      - uses: peaceiris/actions-gh-pages@v4
+      - uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4
         name: GitHub Pages Deploy
         with:
           github_token: ${{ secrets.GH_PAT || github.token }}
diff --git a/.github/workflows/summary.yml b/.github/workflows/summary.yml
index 59185cc96..fa2d72ae2 100644
--- a/.github/workflows/summary.yml
+++ b/.github/workflows/summary.yml
@@ -1,18 +1,10 @@
 #
-# ===============================
-# Do not edit this file directly!
-# ===============================
+# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then
+# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are
+# passed to them, and the token gets only the permissions it needs.
+# Update Template CI and the template step of Setup CI are off, so these
+# edits are not overwritten. Change sites in .upptimerc.yml as usual.
 #
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.41.0
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
 
 name: Summary CI
 on:
@@ -21,18 +13,20 @@ on:
   repository_dispatch:
     types: [summary]
   workflow_dispatch:
+permissions:
+  contents: write
 jobs:
   release:
     name: Generate README
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT || github.token }}
       - name: Update summary in README
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "readme"
         env:
diff --git a/.github/workflows/uptime.yml b/.github/workflows/uptime.yml
index 4773d0cad..5172689d1 100644
--- a/.github/workflows/uptime.yml
+++ b/.github/workflows/uptime.yml
@@ -1,18 +1,10 @@
 #
-# ===============================
-# Do not edit this file directly!
-# ===============================
+# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then
+# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are
+# passed to them, and the token gets only the permissions it needs.
+# Update Template CI and the template step of Setup CI are off, so these
+# edits are not overwritten. Change sites in .upptimerc.yml as usual.
 #
-# Your changes will be overwritten when the Upptime template updates (by default, weekly)
-# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly.
-#
-# 🔼 Upptime @v1.41.0
-# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary
-
-# * Source: https://github.com/upptime/upptime
-# * Docs and more: https://upptime.js.org
-# * More by Anand Chowdhary: https://anandchowdhary.com
-
 
 name: Uptime CI
 on:
@@ -21,20 +13,22 @@ on:
   repository_dispatch:
     types: [uptime]
   workflow_dispatch:
+permissions:
+  contents: write
+  issues: write
 jobs:
   release:
     name: Check status
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.GH_PAT || github.token }}
       - name: Check endpoint status
-        uses: upptime/uptime-monitor@v1.41.0
+        uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0
         with:
           command: "update"
         env:
           GH_PAT: ${{ secrets.GH_PAT || github.token }}
-          SECRETS_CONTEXT: ${{ toJson(secrets) }}
diff --git a/.upptimerc.yml b/.upptimerc.yml
index 2f7562d1f..ef2cf2fb6 100644
--- a/.upptimerc.yml
+++ b/.upptimerc.yml
@@ -47,16 +47,17 @@ sites:
     icon: https://rate.vn/img/rate-logo-64.png
     maxResponseTime: 5000
 
-  # 503 when the Supabase read fails (DOS/Rate#829). Cold starts take up to ~9 s.
+  # 503 when the Supabase read fails (DOS/Rate#829). Vercel cold starts took
+  # 4-8.5 s when measured, so the slow threshold leaves headroom.
   - name: Rate.vn Health
     url: https://rate.vn/api/health
     icon: https://rate.vn/img/rate-logo-64.png
-    maxResponseTime: 10000
+    maxResponseTime: 15000
 
   - name: Rate.vn API
     url: https://rate.vn/api/v1/rate/stats
     icon: https://rate.vn/img/rate-logo-64.png
-    maxResponseTime: 5000
+    maxResponseTime: 10000
 
 status-website:
   cname: status.dos.ai