diff --git a/.github/workflows/build-artifacts.yml b/.github/workflows/build-artifacts.yml
index 3dac463..db4273f 100644
--- a/.github/workflows/build-artifacts.yml
+++ b/.github/workflows/build-artifacts.yml
@@ -44,7 +44,7 @@ jobs:
             build_type: unix
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}
@@ -61,7 +61,7 @@ jobs:
 
       - name: Cache ccache (Linux)
         if: matrix.os_name == 'linux'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ccache
           key: ${{ matrix.os_name }}-ccache-${{ github.sha }}
@@ -77,7 +77,7 @@ jobs:
 
       - name: Cache linuxdeploy (Linux)
         if: matrix.os_name == 'linux'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: /tmp/linuxdeploy
           key: linuxdeploy-x86_64-continuous
@@ -85,7 +85,7 @@ jobs:
       # =========== macOS Setup ===========
       - name: Cache Homebrew
         if: matrix.os_name == 'macos'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/Library/Caches/Homebrew
@@ -104,14 +104,14 @@ jobs:
       # =========== Windows Setup ===========
       - name: Setup vcpkg (Windows)
         if: matrix.build_type == 'msvc'
-        uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
+        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6
         with:
           vcpkgGitCommitId: '84bab45d415d22042bd0b9081aea57f362da3f35'  # 2025.12.12
           vcpkgJsonGlob: 'vcpkg.json'
 
       - name: Setup CMake and Ninja (Windows)
         if: matrix.build_type == 'msvc'
-        uses: lukka/get-cmake@9e07ecdcee1b12e5037e42f410b67f03e2f626e1 # v4.2.1
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
 
       - name: Install NSIS with Large Strings (Windows)
         if: matrix.build_type == 'msvc'
@@ -147,12 +147,12 @@ jobs:
       # =========== Unix Setup ===========
       - name: Setup CMake and Ninja (Unix)
         if: matrix.build_type == 'unix'
-        uses: lukka/get-cmake@9e07ecdcee1b12e5037e42f410b67f03e2f626e1 # v4.2.1
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
 
       # =========== Build ===========
       - name: Build and test (Windows)
         if: matrix.build_type == 'msvc'
-        uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8
+        uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
         with:
           configurePreset: 'windows-msvc'
           buildPreset: 'windows-msvc'
@@ -160,7 +160,7 @@ jobs:
 
       - name: Build and test (Unix)
         if: matrix.build_type == 'unix'
-        uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8
+        uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
         with:
           configurePreset: 'default'
           buildPreset: 'default'
@@ -257,7 +257,7 @@ jobs:
       # =========== Upload ===========
       - name: Upload artifacts (Linux)
         if: matrix.os_name == 'linux'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: headsetcontrol-${{ matrix.os_name }}
           path: |
@@ -273,7 +273,7 @@ jobs:
 
       - name: Upload artifacts (macOS)
         if: matrix.os_name == 'macos'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: headsetcontrol-${{ matrix.os_name }}
           path: |
@@ -283,7 +283,7 @@ jobs:
 
       - name: Upload artifacts (Windows)
         if: matrix.build_type == 'msvc'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: headsetcontrol-${{ matrix.os_name }}
           path: |
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 18f30ac..852c574 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,14 +33,14 @@ jobs:
             shell: msys2 {0}
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       # Windows: Setup MSYS2
       - name: Setup MSYS2
         if: runner.os == 'Windows'
-        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
+        uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
         with:
           msystem: MINGW64
           update: true
@@ -52,7 +52,7 @@ jobs:
       # Linux/macOS: Setup CMake and Ninja
       - name: Setup CMake and Ninja
         if: runner.os != 'Windows'
-        uses: lukka/get-cmake@9e07ecdcee1b12e5037e42f410b67f03e2f626e1 # v4.2.1
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
 
       # Linux: Install GCC 13 for C++20 support
       - name: Install GCC 13 (Ubuntu)
@@ -72,7 +72,7 @@ jobs:
       # Linux/macOS: Build with CMake Presets
       - name: Build and test (Unix)
         if: runner.os != 'Windows'
-        uses: lukka/run-cmake@af1be47fd7c933593f687731bc6fdbee024d3ff4 # v10.8
+        uses: lukka/run-cmake@5d55ea7949e25f69f0ecb516d8d572297e03a956 # v10.9
         with:
           configurePreset: 'default'
           buildPreset: 'default'
@@ -95,7 +95,7 @@ jobs:
       # Upload Windows artifact for testing
       - name: Upload Windows artifact
         if: runner.os == 'Windows'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: headsetcontrol-windows-mingw
           path: build/headsetcontrol.exe
diff --git a/.github/workflows/bump-homebrew.yml b/.github/workflows/bump-homebrew.yml
index 0c3b7ee..6d46832 100644
--- a/.github/workflows/bump-homebrew.yml
+++ b/.github/workflows/bump-homebrew.yml
@@ -35,7 +35,7 @@ jobs:
           echo "Bumping to $TAG ($sha)"
 
       - name: Checkout tap
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Sapd/homebrew-headsetcontrol
           ssh-key: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml
index 4d7afbc..0b63462 100644
--- a/.github/workflows/check-whitespace.yml
+++ b/.github/workflows/check-whitespace.yml
@@ -11,7 +11,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -55,7 +55,7 @@ jobs:
 
       # Always look for existing comment (to update or delete)
       - name: Find existing comment
-        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
         id: find-comment
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -65,7 +65,7 @@ jobs:
       # Delete old failure comment when check passes
       - name: Delete old comment if check passes
         if: steps.check.outputs.has_errors == 'false' && steps.find-comment.outputs.comment-id != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             await github.rest.issues.deleteComment({
@@ -77,7 +77,7 @@ jobs:
       # Create or update failure comment
       - name: Create or update PR comment
         if: steps.check.outputs.has_errors == 'true'
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index 8ea6891..16f4ddc 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -1,7 +1,7 @@
 name: Code Style Check
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - '**.c'
       - '**.cpp'
@@ -14,19 +14,22 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: write
     steps:
-      # Security note: Checking out fork code with pull_request_target is safe here
-      # because clang-format only parses source files for formatting, it does not
-      # execute any code. No build scripts or PR code are run.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      # Runs on pull_request, not pull_request_target: this job needs no write
+      # access, so it does not need the base-repo token. Feedback goes out via
+      # the step summary and file annotations, neither of which touches an API.
+      # Fork PRs therefore work with the read-only token they are granted, and
+      # untrusted PR code cannot reach anything privileged.
+      #
+      # No `repository:` input is needed -- GitHub replicates the PR head into
+      # the base repo, so the head SHA is fetchable from here.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Run cpp-linter
-        uses: cpp-linter/cpp-linter-action@b6edc0625e3941baa1797f4b4326adeab6890c97 # v2.16.7
+        uses: cpp-linter/cpp-linter-action@8e85cd02c8c3fe3ae527c94b5683fe2366b144ed # v2.20.0
         id: linter
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -36,16 +39,16 @@ jobs:
           version: '18'
           files-changed-only: true
           lines-changed-only: false
-          # Disable thread-comments to avoid 403 errors
-          # The commits comments API requires contents:write which is unsafe with pull_request_target
-          # Use step-summary and file-annotations for feedback instead
+          # Thread comments need the commits API (contents:write), which a fork
+          # PR's read-only token cannot use. Feedback goes via step-summary and
+          # file-annotations instead, which need no permissions at all.
           thread-comments: false
           step-summary: true
           file-annotations: true
           extensions: 'c,cpp,h,hpp'
 
       - name: Fail if formatting issues found
-        if: steps.linter.outputs.format-checks-failed > 0
+        if: steps.linter.outputs.clang-format-checks-failed > 0
         run: |
-          echo "::error::Found ${{ steps.linter.outputs.format-checks-failed }} formatting issues"
+          echo "::error::Found ${{ steps.linter.outputs.clang-format-checks-failed }} formatting issues"
           exit 1
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index e9a5881..f98ea7f 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || format('refs/pull/{0}/merge', inputs.pr_number) }}
diff --git a/.github/workflows/continuos-release.yml b/.github/workflows/continuos-release.yml
index 8c8efd9..5c1e003 100644
--- a/.github/workflows/continuos-release.yml
+++ b/.github/workflows/continuos-release.yml
@@ -32,12 +32,12 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true
           path: ./artifacts
@@ -95,7 +95,7 @@ jobs:
           echo "*Built from [\`${GITHUB_SHA:0:7}\`](https://github.com/${{ github.repository }}/commit/${{ github.sha }})*" >> CHANGELOG.md
 
       - name: Create/Update release
-        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: continuous
           name: 'Continuous Build'
diff --git a/.github/workflows/copr-build.yml b/.github/workflows/copr-build.yml
index e603fe4..43a883e 100644
--- a/.github/workflows/copr-build.yml
+++ b/.github/workflows/copr-build.yml
@@ -26,7 +26,7 @@ jobs:
     env:
       TAG: ${{ github.event.release.tag_name || inputs.tag }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.release.tag_name || inputs.tag }}
diff --git a/.github/workflows/ppa-upload.yml b/.github/workflows/ppa-upload.yml
index b31da99..446f15b 100644
--- a/.github/workflows/ppa-upload.yml
+++ b/.github/workflows/ppa-upload.yml
@@ -36,7 +36,7 @@ jobs:
       DEBFULLNAME: Denis Arnst
       SIGN_KEY: 893E9C96C0E1A0CE52CF88FD12C8E71EC92CF077
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.inputs.tag || github.ref }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a18f663..fc89ac9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,13 +38,13 @@ jobs:
     env:
       TAG: ${{ github.event.inputs.tag || github.ref_name }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.TAG }}
 
       - name: Download all artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true
           path: ./artifacts
@@ -86,7 +86,7 @@ jobs:
           echo "Signed artifacts:"; ls -1
 
       - name: Create release
-        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ env.TAG }}
           name: ${{ env.TAG }}
diff --git a/.github/workflows/repo-device-requested.yml b/.github/workflows/repo-device-requested.yml
index 32cad40..5dfed40 100644
--- a/.github/workflows/repo-device-requested.yml
+++ b/.github/workflows/repo-device-requested.yml
@@ -12,7 +12,7 @@ jobs:
       issues: write
     steps:
       - name: Add helpful comment
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ github.event.issue.number }}
           body: |
diff --git a/.github/workflows/repo-stale.yml b/.github/workflows/repo-stale.yml
index 4885aa9..3532a11 100644
--- a/.github/workflows/repo-stale.yml
+++ b/.github/workflows/repo-stale.yml
@@ -12,7 +12,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           stale-issue-message: >
             This issue has been automatically marked as stale because it has been