diff --git a/.github/workflows/bump-pins.yml b/.github/workflows/bump-pins.yml
index 27ae96b..1590d48 100644
--- a/.github/workflows/bump-pins.yml
+++ b/.github/workflows/bump-pins.yml
@@ -41,7 +41,7 @@ jobs:
       contents: write        # push the bump branch
       pull-requests: write   # open the PR
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       # No third-party action is used to open the PR. `gh` ships on the runner,
       # so this adds zero new supply-chain trust to a repo whose whole purpose is
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0246c85..b09beae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: bash -n (parse check)
         run: |
           set -euo pipefail
@@ -89,7 +89,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: audit.sh
         run: ./audit.sh
 
@@ -104,7 +104,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
       - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
@@ -119,7 +119,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: sync.sh --check (self-only)
         # EGRESS_SELF_ONLY restricts the target list to BOTH in-repo devcontainers
         # (the sibling fleet repos aren't checked out here). Unlike the old hand-rolled
@@ -168,9 +168,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: hadolint
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387
         with:
           dockerfile: ${{ matrix.dockerfile }}
           # DL3008 (pin apt versions) is a deliberate tradeoff here — the image
@@ -186,7 +186,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: squid -k parse
         # squid.conf isn't shell, so the shell job ignores it; validate its directive
         # syntax here so a semantically-broken proxy config fails CI instead of only
@@ -225,9 +225,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: set up buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
       - name: build image (GHA layer cache)
         # The Dockerfile is BUILT here (hadolint/Trivy only lint/scan it), catching a
         # build that lints clean but breaks. Layers are cached in the GHA cache
@@ -235,7 +235,7 @@ jobs:
         # touch only the final cheap COPY layers, and without a persisted cache CI
         # re-paid the full apt + Node/Python download + npm install build (~4-8 min,
         # the long pole of the pipeline) on every run. Cache-hit builds take seconds.
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         with:
           context: ${{ matrix.context }}
           tags: ${{ matrix.image }}
@@ -272,7 +272,7 @@ jobs:
       contents: read
       security-events: write # required to upload SARIF to GitHub Security
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run Trivy scan (SARIF — fail on HIGH/CRITICAL)
         # ONE scan does both duties: Trivy writes the SARIF report BEFORE applying
@@ -291,7 +291,7 @@ jobs:
 
       - name: Upload Trivy SARIF to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63
         with:
           sarif_file: trivy-results.sarif
           category: trivy
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e93b4cd..1f3ac23 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -50,10 +50,10 @@ jobs:
       matrix:
         language: [actions]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63
         with:
           languages: ${{ matrix.language }}
           # Actions workflows are declarative YAML — nothing to build.
@@ -61,4 +61,4 @@ jobs:
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63