diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index a52e972..c5bf510 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -24,6 +24,6 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       post_command: python3 scripts/check_action_pins.py .github/workflows
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 702b269..4fd9cdf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
       matrix:
         os: [ubuntu-latest]
         language: ["javascript-typescript", "python"]
-    uses: NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       runner: ${{ matrix.os }}
       languages: '["${{ matrix.language }}"]'
diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml
index 9625649..8267f65 100644
--- a/.github/workflows/cross-platform.yml
+++ b/.github/workflows/cross-platform.yml
@@ -30,7 +30,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-    uses: NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       os_list: '["${{ matrix.os }}"]'
       timeout_minutes: 10
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index a3fc430..ec0efc7 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -25,10 +25,10 @@ jobs:
     steps:
       # Actions pinned to commit SHA — see validate.yml header for rationale.
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index b76af67..0317cd9 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       fail_on_severity: moderate
       comment_summary_in_pr: on-failure
diff --git a/.github/workflows/instruction-docs-check.yml b/.github/workflows/instruction-docs-check.yml
index 832fcc5..29299e4 100644
--- a/.github/workflows/instruction-docs-check.yml
+++ b/.github/workflows/instruction-docs-check.yml
@@ -43,15 +43,15 @@ jobs:
     timeout-minutes: 8
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Validate instruction docs
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d4a0772..aa14fa4 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -33,9 +33,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Install ruff (pinned)
diff --git a/.github/workflows/opencode-runtime.yml b/.github/workflows/opencode-runtime.yml
index d4684ea..046c15a 100644
--- a/.github/workflows/opencode-runtime.yml
+++ b/.github/workflows/opencode-runtime.yml
@@ -55,7 +55,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
@@ -82,7 +82,7 @@ jobs:
           grep -q '"moonshotai/kimi-k2.7-code"' /tmp/opencode-debug-config.txt
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6f4a23d..f21417d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,11 +31,11 @@ jobs:
       attestations: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -98,7 +98,7 @@ jobs:
           printf 'tag=%s\n' "$release_version" >> "$GITHUB_OUTPUT"
           printf 'version=%s\n' "$current" >> "$GITHUB_OUTPUT"
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Set up Bun
@@ -171,12 +171,12 @@ jobs:
           retention-days: 30
       - name: Attest release evidence bundle
         if: matrix.os == 'ubuntu-latest'
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
         with:
           subject-path: release-evidence.tgz
       - name: Attest generated SBOM
         if: matrix.os == 'ubuntu-latest'
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
         with:
           subject-path: sbom.json
       - name: Publish GitHub Release
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index db21499..7ccb21d 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -18,11 +18,11 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Bun
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b551a59..67ac203 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,6 +20,6 @@ jobs:
       id-token: write
       contents: read
       actions: read
-    uses: NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       publish_results: false
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index e957fff..b1636ea 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -21,6 +21,6 @@ jobs:
     name: gitleaks
     permissions:
       contents: read
-    uses: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
+    uses: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0
     with:
       gitleaks_config_path: .gitleaks.toml
diff --git a/.github/workflows/typecheck-plugins.yml b/.github/workflows/typecheck-plugins.yml
index 2dde236..676badc 100644
--- a/.github/workflows/typecheck-plugins.yml
+++ b/.github/workflows/typecheck-plugins.yml
@@ -33,9 +33,9 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "22"
       - name: Set up Bun
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index b34d217..f43cc21 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -33,9 +33,9 @@ jobs:
       # tag hijack on the action repository). Update SHAs in lockstep when
       # bumping the major version; verify via `gh api repos/actions/<name>/git/refs/tags/<tag>`.
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
 
@@ -109,9 +109,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Verify shell strictness contract