diff --git a/.github/actions/package-toolchain/action.yml b/.github/actions/package-toolchain/action.yml
index 872ddec028..c173954e5e 100644
--- a/.github/actions/package-toolchain/action.yml
+++ b/.github/actions/package-toolchain/action.yml
@@ -32,7 +32,7 @@ runs:
         echo "toolchain-cache key: $KEY"
 
     - name: Cache musl sysroot + libc++
-      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       id: cache
       with:
         path: |
diff --git a/.github/workflows/abi-staging-merge-gate.yml b/.github/workflows/abi-staging-merge-gate.yml
index d4d00b17a3..033e79e22e 100644
--- a/.github/workflows/abi-staging-merge-gate.yml
+++ b/.github/workflows/abi-staging-merge-gate.yml
@@ -69,7 +69,7 @@ jobs:
       PR_HEAD_SHA: ${{ needs.capture-current-subject.outputs.exact-head }}
     steps:
       - name: Checkout captured protected ABI authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.protected-sha }}
           fetch-depth: 1
@@ -77,7 +77,7 @@ jobs:
           path: abi-staging-authority
 
       - name: Checkout exact PR head for structural ABI check
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.exact-head }}
           fetch-depth: 1
@@ -235,7 +235,7 @@ jobs:
       PROTECTED_SHA: ${{ needs.capture-current-subject.outputs.protected-sha }}
     steps:
       - name: Checkout captured protected ABI gate authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.protected-sha }}
           fetch-depth: 1
@@ -243,7 +243,7 @@ jobs:
           path: abi-staging-authority
 
       - name: Checkout inert exact PR head for ABI gate
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.capture-current-subject.outputs.exact-head }}
           fetch-depth: 1
diff --git a/.github/workflows/abi-staging-pages-canary.yml b/.github/workflows/abi-staging-pages-canary.yml
index b0910ba667..fba574192a 100644
--- a/.github/workflows/abi-staging-pages-canary.yml
+++ b/.github/workflows/abi-staging-pages-canary.yml
@@ -22,7 +22,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the exact protected source commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -47,7 +47,7 @@ jobs:
           submodules: libc/musl
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           package-manager-cache: false
diff --git a/.github/workflows/abi-staging-pr-check.yml b/.github/workflows/abi-staging-pr-check.yml
index fbbe2b0ceb..8f4a4cd40c 100644
--- a/.github/workflows/abi-staging-pr-check.yml
+++ b/.github/workflows/abi-staging-pr-check.yml
@@ -141,7 +141,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout captured protected Kandelo authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.enumerate-open-prs.outputs.protected-sha }}
           fetch-depth: 1
@@ -149,7 +149,7 @@ jobs:
           path: authority
 
       - name: Checkout captured protected tap authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ needs.enumerate-open-prs.outputs.tap-sha }}
@@ -158,7 +158,7 @@ jobs:
           path: tap
 
       - name: Checkout inert exact PR head
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ matrix.subject.head_repository }}
           ref: ${{ matrix.subject.head }}
@@ -323,7 +323,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout captured protected Kandelo authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.enumerate-open-prs.outputs.protected-sha }}
           fetch-depth: 1
diff --git a/.github/workflows/abi-staging-request-feed.yml b/.github/workflows/abi-staging-request-feed.yml
index 537123c67e..5212ff4807 100644
--- a/.github/workflows/abi-staging-request-feed.yml
+++ b/.github/workflows/abi-staging-request-feed.yml
@@ -139,7 +139,7 @@ jobs:
           printf 'subjects-sha256=%s\n' "$subjects_sha256" >>"$GITHUB_OUTPUT"
 
       - name: Checkout captured protected authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.resolve.outputs.protected-sha }}
           fetch-depth: 1
@@ -295,7 +295,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout captured protected authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.classify-exact-head.outputs.protected-sha }}
           fetch-depth: 1
@@ -462,7 +462,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout captured protected authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.classify-exact-head.outputs.protected-sha }}
           fetch-depth: 1
diff --git a/.github/workflows/activate-merge-candidate.yml b/.github/workflows/activate-merge-candidate.yml
index 1c8a8a027f..065db79e3d 100644
--- a/.github/workflows/activate-merge-candidate.yml
+++ b/.github/workflows/activate-merge-candidate.yml
@@ -51,7 +51,7 @@ jobs:
       # Always run the current default-branch protocol. A candidate may have
       # been prepared by a PR that changed these scripts; pre-merge code must
       # never activate canonical state.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0
diff --git a/.github/workflows/browser-demos-ci.yml b/.github/workflows/browser-demos-ci.yml
index 2f221d47c9..59a8b85582 100644
--- a/.github/workflows/browser-demos-ci.yml
+++ b/.github/workflows/browser-demos-ci.yml
@@ -39,8 +39,8 @@ jobs:
     name: COI smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
diff --git a/.github/workflows/browser-demos-pages.yml b/.github/workflows/browser-demos-pages.yml
index 605e089110..73b4b7a593 100644
--- a/.github/workflows/browser-demos-pages.yml
+++ b/.github/workflows/browser-demos-pages.yml
@@ -28,7 +28,7 @@ jobs:
       deploy: ${{ steps.shipping.outputs.ready == 'true' && steps.publish_freshness.outputs.publish == 'true' }}
     steps:
       - name: Check out the exact protected source commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.source_sha }}
           fetch-depth: 1
@@ -77,7 +77,7 @@ jobs:
           submodules: libc/musl
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           package-manager-cache: false
diff --git a/.github/workflows/force-rebuild.yml b/.github/workflows/force-rebuild.yml
index ebb6cf27e2..23aab64fdc 100644
--- a/.github/workflows/force-rebuild.yml
+++ b/.github/workflows/force-rebuild.yml
@@ -199,7 +199,7 @@ jobs:
       target_tag: ${{ steps.compute.outputs.target_tag }}
       expected_ledger_artifact: ${{ steps.compute.outputs.expected_ledger_artifact }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -228,7 +228,7 @@ jobs:
         run: bash scripts/dev-shell.sh true
 
       - name: Cache xtask build
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -340,7 +340,7 @@ jobs:
     needs: [gate]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -372,7 +372,7 @@ jobs:
           echo "toolchain-cache key: $KEY"
 
       - name: Cache musl sysroot + libc++
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache
         with:
           path: |
@@ -439,7 +439,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_0_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -470,7 +470,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_1_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -501,7 +501,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_2_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -532,7 +532,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_3_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -563,7 +563,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_4_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -594,7 +594,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_5_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -625,7 +625,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_6_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -656,7 +656,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.level_7_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
       - uses: ./.github/actions/exact-main-package-rebuild
@@ -698,7 +698,7 @@ jobs:
     env:
       WASM_POSIX_BINARY_INDEX_URL: https://github.com/${{ github.repository }}/releases/download/${{ needs.preflight.outputs.target_tag }}/index.toml
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -892,7 +892,7 @@ jobs:
       SUITE: ${{ matrix.suite }}
       TEST_GROUP: ${{ matrix.group }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
@@ -987,7 +987,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       PACKAGE_TARGET_TAG: ${{ needs.preflight.outputs.target_tag }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.gate.outputs.source_sha }}
 
diff --git a/.github/workflows/homebrew-experimental-vfs-publish.yml b/.github/workflows/homebrew-experimental-vfs-publish.yml
index 82d0590118..297a9bcac1 100644
--- a/.github/workflows/homebrew-experimental-vfs-publish.yml
+++ b/.github/workflows/homebrew-experimental-vfs-publish.yml
@@ -38,7 +38,7 @@ jobs:
       rootfs_bytes: ${{ steps.identify_candidate.outputs.rootfs_bytes }}
     steps:
       - name: Checkout exact Kandelo source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 1
@@ -55,7 +55,7 @@ jobs:
           test -d libc/musl/src
 
       - name: Checkout exact Homebrew tap source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ inputs.tap-revision }}
@@ -63,7 +63,7 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
@@ -225,14 +225,14 @@ jobs:
       report_bytes: ${{ steps.identify.outputs.report_bytes }}
     steps:
       - name: Checkout exact Kandelo source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 1
           persist-credentials: false
 
       - name: Checkout exact Homebrew tap source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ inputs.tap-revision }}
@@ -240,7 +240,7 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
diff --git a/.github/workflows/homebrew-main-shell-ci.yml b/.github/workflows/homebrew-main-shell-ci.yml
index 942bc15f2d..54c5b9bf06 100644
--- a/.github/workflows/homebrew-main-shell-ci.yml
+++ b/.github/workflows/homebrew-main-shell-ci.yml
@@ -80,7 +80,7 @@ jobs:
       product_state: ${{ steps.product.outputs.state }}
       selection_ready: ${{ steps.product.outputs.selection_ready }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.pull_request_head_sha || github.sha }}
           fetch-depth: 0
@@ -143,7 +143,7 @@ jobs:
       # wrong artifact again.
       SHELL_ACTIVATION_MODE: bottles
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.pull_request_head_sha || github.sha }}
           persist-credentials: false
@@ -238,7 +238,7 @@ jobs:
         with:
           submodules: libc/musl
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
diff --git a/.github/workflows/homebrew-native-publisher-compatibility.yml b/.github/workflows/homebrew-native-publisher-compatibility.yml
index aeb1f758ed..676adf82d6 100644
--- a/.github/workflows/homebrew-native-publisher-compatibility.yml
+++ b/.github/workflows/homebrew-native-publisher-compatibility.yml
@@ -22,14 +22,14 @@ jobs:
       contents: read
     steps:
       - name: Checkout exact PR head
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
           submodules: false
 
       - name: Checkout exact reviewed Homebrew source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Homebrew/brew
diff --git a/.github/workflows/prepare-merge.yml b/.github/workflows/prepare-merge.yml
index 44924a2146..772fdfa786 100644
--- a/.github/workflows/prepare-merge.yml
+++ b/.github/workflows/prepare-merge.yml
@@ -230,7 +230,7 @@ jobs:
       package_staging_required: ${{ steps.route.outputs.package_staging_required }}
       package_staging_reason: ${{ steps.route.outputs.package_staging_reason }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 0
@@ -273,7 +273,7 @@ jobs:
           base-ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-base: "false"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           path: abi-staging-authority
@@ -393,7 +393,7 @@ jobs:
       # Approval verification executes trusted base-branch code, never helper
       # code supplied by the pull request receiving the write-capable token.
       - name: Checkout approval verifier
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           sparse-checkout: .github/scripts/require-exact-head-approval.sh
@@ -483,7 +483,7 @@ jobs:
           needs.change-scope.outputs.exact_abi_staging_applicable != 'true' &&
           (needs.change-scope.outputs.package_staging_required == 'true' ||
            needs.change-scope.outputs.test_gate_required == 'true')
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # WHY: this selector runs beside a write-capable token. The pull
           # request may change its future behavior, but it cannot replace the
@@ -926,7 +926,7 @@ jobs:
       staging_tag: ${{ steps.compute.outputs.staging_tag }}
       merge_base_sha: ${{ steps.compute.outputs.merge_base_sha }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -979,7 +979,7 @@ jobs:
         run: bash scripts/dev-shell.sh true
 
       - name: Cache xtask build
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -1242,7 +1242,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -1300,7 +1300,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.preflight.outputs.promote_matrix) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -1396,7 +1396,7 @@ jobs:
         include: ${{ fromJSON(needs.preflight.outputs.library_matrix) }}
     steps:
       - id: checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -1517,7 +1517,7 @@ jobs:
         include: ${{ fromJSON(needs.preflight.outputs.program_matrix) }}
     steps:
       - id: checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -1625,7 +1625,7 @@ jobs:
       BINARY_MATERIALIZATION_CHANGED: ${{ needs.change-scope.outputs.binary_materialization_changed }}
       EXACT_ABI_STAGING_APPLICABLE: ${{ needs.change-scope.outputs.exact_abi_staging_applicable }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -1756,7 +1756,7 @@ jobs:
           fi
           echo "skip=false" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.suite.outputs.skip != 'true'
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
@@ -1823,7 +1823,7 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -1890,7 +1890,7 @@ jobs:
               -o host/test/fixtures/deep-wasm-recursion.wasm
           '
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           path: abi-staging-authority
@@ -1964,7 +1964,7 @@ jobs:
             route: sortix runtime
             submodules: tests/sortix/os-test
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -2021,7 +2021,7 @@ jobs:
           name: exact-abi-source-test-workspace
           path: ${{ runner.temp }}/exact-abi-source-test-workspace
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           path: abi-staging-authority
@@ -2285,7 +2285,7 @@ jobs:
       STAGING_SHELL_RUN_ID: ${{ needs.staging-shell-snapshot.outputs.run_id }}
       USE_STAGING_SHELL_HANDOFF: "false"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
           fetch-depth: 1
@@ -2808,7 +2808,7 @@ jobs:
           fi
           echo "skip=false" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.suite.outputs.skip != 'true'
         with:
           ref: ${{ needs.synthesize-merge.outputs.base_sha }}
@@ -3236,7 +3236,7 @@ jobs:
           fi
 
       - name: Checkout candidate lifecycle helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # This job has release-write authority. Execute lifecycle code from
           # the exact trusted base that was synthesized and tested, never from
diff --git a/.github/workflows/preserve-pr-package-generation.yml b/.github/workflows/preserve-pr-package-generation.yml
index b33518e967..8496011de0 100644
--- a/.github/workflows/preserve-pr-package-generation.yml
+++ b/.github/workflows/preserve-pr-package-generation.yml
@@ -56,7 +56,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout current publishing authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
@@ -64,7 +64,7 @@ jobs:
           path: authority
 
       - name: Checkout exact package source without credentials
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.package-source-sha }}
           fetch-depth: 1
@@ -135,7 +135,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout current publishing authority without persisted credentials
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/promote-package-generation.yml b/.github/workflows/promote-package-generation.yml
index 5037e63e72..5a548a008c 100644
--- a/.github/workflows/promote-package-generation.yml
+++ b/.github/workflows/promote-package-generation.yml
@@ -70,7 +70,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout current publishing authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
@@ -91,7 +91,7 @@ jobs:
           fi
 
       - name: Checkout immutable package producer as inert data
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.producer-sha }}
           fetch-depth: 1
@@ -184,7 +184,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout current publishing authority without persisted credentials
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
@@ -192,7 +192,7 @@ jobs:
           path: authority
 
       - name: Checkout immutable package producer as inert data
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.producer-sha }}
           fetch-depth: 1
diff --git a/.github/workflows/recover-rejected-merge-candidate.yml b/.github/workflows/recover-rejected-merge-candidate.yml
index da3109b321..e098b3440a 100644
--- a/.github/workflows/recover-rejected-merge-candidate.yml
+++ b/.github/workflows/recover-rejected-merge-candidate.yml
@@ -27,7 +27,7 @@ jobs:
       GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
       SOURCE_CANDIDATE_TAG: ${{ inputs.source_candidate_tag }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0
diff --git a/.github/workflows/reusable-homebrew-bottle-maintenance.yml b/.github/workflows/reusable-homebrew-bottle-maintenance.yml
index 2e4a6552d8..2b9d9601e3 100644
--- a/.github/workflows/reusable-homebrew-bottle-maintenance.yml
+++ b/.github/workflows/reusable-homebrew-bottle-maintenance.yml
@@ -127,7 +127,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout tap
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: main
@@ -135,7 +135,7 @@ jobs:
           fetch-depth: 0
 
       - name: Checkout Kandelo workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Automattic/kandelo
diff --git a/.github/workflows/reusable-homebrew-bottle-publish.yml b/.github/workflows/reusable-homebrew-bottle-publish.yml
index f732fba80f..84c4b1a038 100644
--- a/.github/workflows/reusable-homebrew-bottle-publish.yml
+++ b/.github/workflows/reusable-homebrew-bottle-publish.yml
@@ -565,7 +565,7 @@ jobs:
           esac
 
       - name: Checkout Kandelo workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -574,7 +574,7 @@ jobs:
           submodules: false
 
       - name: Checkout tap
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -1217,7 +1217,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout Kandelo workflow source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -1226,7 +1226,7 @@ jobs:
           submodules: false
 
       - name: Checkout tap
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -1399,7 +1399,7 @@ jobs:
           echo "KANDELO_HOMEBREW_RESOLVED_TAPS_FILE=$resolved" >> "$GITHUB_ENV"
 
       - name: Checkout reviewed Homebrew implementation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Homebrew/brew
@@ -2034,7 +2034,7 @@ jobs:
           done
 
       - name: Checkout exact post-build Kandelo validator source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -2043,7 +2043,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact post-build tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -2352,7 +2352,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout exact Kandelo validator source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -2361,7 +2361,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact tap source for upload validation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -2663,7 +2663,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.formula-matrix) }}
     steps:
       - name: Checkout exact Kandelo index publisher source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -2672,7 +2672,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact tap source for index validation
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -3209,7 +3209,7 @@ jobs:
         include: ${{ fromJson(needs.plan.outputs.matrix) }}
     steps:
       - name: Checkout exact Kandelo verifier source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -3218,7 +3218,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact Kandelo sysroot build source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -3227,7 +3227,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -3393,7 +3393,7 @@ jobs:
           echo "KANDELO_HOMEBREW_RESOLVED_TAPS_FILE=$resolved" >> "$GITHUB_ENV"
 
       - name: Checkout reviewed Homebrew implementation for bottle verification
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Homebrew/brew
@@ -4277,7 +4277,7 @@ jobs:
           done
 
       - name: Checkout exact post-verification Kandelo generator source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -4286,7 +4286,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact post-verification tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -5231,7 +5231,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout exact Kandelo finalizer source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -5240,7 +5240,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact base tap without credentials
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
@@ -5382,7 +5382,7 @@ jobs:
 
       - name: Checkout tap publication branch after payload validation
         if: ${{ steps.validate-payload.outcome == 'success' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ inputs.tap-repository }}
           ref: main
@@ -5449,7 +5449,7 @@ jobs:
 
       - name: Checkout clean tap for a failed-attempt report
         if: ${{ always() && (steps.publish-handoffs.outcome != 'success' || steps.validate-payload.outcome != 'success' || steps.publish.outcome != 'success') }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ inputs.tap-repository }}
           ref: main
@@ -5532,7 +5532,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout exact Kandelo VFS release source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.kandelo-repository }}
@@ -5541,7 +5541,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact VFS source tap without credentials
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: ${{ inputs.tap-repository }}
diff --git a/.github/workflows/reusable-homebrew-closed-selection-publish.yml b/.github/workflows/reusable-homebrew-closed-selection-publish.yml
index fabd293867..9bc9143ae5 100644
--- a/.github/workflows/reusable-homebrew-closed-selection-publish.yml
+++ b/.github/workflows/reusable-homebrew-closed-selection-publish.yml
@@ -70,7 +70,7 @@ jobs:
           [[ "$PLAN_SHA256" =~ ^[0-9a-f]{64}$ ]]
 
       - name: Checkout exact Kandelo publisher
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Automattic/kandelo
           ref: ${{ inputs.kandelo-ref }}
@@ -131,7 +131,7 @@ jobs:
               --github-output "$GITHUB_OUTPUT"
 
       - name: Checkout exact campaign source tap
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ steps.admit.outputs.source-tap-commit }}
@@ -230,7 +230,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout exact Kandelo publisher
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Automattic/kandelo
           ref: ${{ inputs.kandelo-ref }}
@@ -239,7 +239,7 @@ jobs:
           submodules: false
 
       - name: Checkout protected tap lock authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ inputs.expected-caller-sha }}
@@ -248,7 +248,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkout exact campaign source for reconstruction
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kandelo-dev/homebrew-tap-core
           ref: ${{ needs.prepare.outputs.source-tap-commit }}
diff --git a/.github/workflows/reusable-homebrew-main-shell-mirror-publish.yml b/.github/workflows/reusable-homebrew-main-shell-mirror-publish.yml
index 0643b50db3..bc5f5c2339 100644
--- a/.github/workflows/reusable-homebrew-main-shell-mirror-publish.yml
+++ b/.github/workflows/reusable-homebrew-main-shell-mirror-publish.yml
@@ -94,7 +94,7 @@ jobs:
           echo "mirror-authority-ref=$tap_mirror_authority_ref" >>"$GITHUB_OUTPUT"
 
       - name: Check out exact Kandelo authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Automattic/kandelo
           ref: ${{ inputs.kandelo-ref }}
@@ -102,7 +102,7 @@ jobs:
           persist-credentials: false
 
       - name: Check out exact tap catalog
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Kandelo-dev/homebrew-tap-core
           ref: ${{ inputs.tap-catalog-ref }}
@@ -110,7 +110,7 @@ jobs:
           persist-credentials: false
 
       - name: Check out protected tap caller authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Kandelo-dev/homebrew-tap-core
           ref: ${{ github.sha }}
@@ -173,7 +173,7 @@ jobs:
               kandelo/homebrew/main-shell-lazy-artifact-lock.json >/dev/null
           fi
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
@@ -567,14 +567,14 @@ jobs:
       contents: write
     steps:
       - name: Check out exact tap authority
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Kandelo-dev/homebrew-tap-core
           ref: ${{ github.sha }}
           persist-credentials: false
 
       - name: Check out exact Kandelo publisher
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Automattic/kandelo
           ref: ${{ inputs.kandelo-ref }}
@@ -771,7 +771,7 @@ jobs:
       contents: read
     steps:
       - name: Check out exact Kandelo Node consumer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Automattic/kandelo
           ref: ${{ inputs.kandelo-ref }}
@@ -789,7 +789,7 @@ jobs:
           name: homebrew-guest-lifecycle-inputs-handoff
           path: ${{ runner.temp }}/homebrew-guest-lifecycle-inputs-handoff
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
@@ -973,7 +973,7 @@ jobs:
       contents: read
     steps:
       - name: Check out exact Kandelo consumer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Automattic/kandelo
           ref: ${{ inputs.kandelo-ref }}
@@ -999,7 +999,7 @@ jobs:
           name: homebrew-guest-lifecycle-inputs-handoff
           path: ${{ runner.temp }}/homebrew-guest-lifecycle-inputs-handoff
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
diff --git a/.github/workflows/reusable-homebrew-prefix-first-child-publish.yml b/.github/workflows/reusable-homebrew-prefix-first-child-publish.yml
index 741c6363b7..0a3be2a8e7 100644
--- a/.github/workflows/reusable-homebrew-prefix-first-child-publish.yml
+++ b/.github/workflows/reusable-homebrew-prefix-first-child-publish.yml
@@ -142,7 +142,7 @@ jobs:
           }
 
       - name: Checkout exact Kandelo bootstrap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Automattic/kandelo
@@ -151,7 +151,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact campaign tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Kandelo-dev/homebrew-tap-core
diff --git a/.github/workflows/reusable-homebrew-repository-namespace-canary.yml b/.github/workflows/reusable-homebrew-repository-namespace-canary.yml
index a52f8cec19..9b287bb745 100644
--- a/.github/workflows/reusable-homebrew-repository-namespace-canary.yml
+++ b/.github/workflows/reusable-homebrew-repository-namespace-canary.yml
@@ -180,7 +180,7 @@ jobs:
           }
 
       - name: Checkout exact Kandelo first-publication source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Automattic/kandelo
@@ -189,7 +189,7 @@ jobs:
           submodules: false
 
       - name: Checkout exact dry-run tap source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: Kandelo-dev/homebrew-tap-core
diff --git a/.github/workflows/reusable-package-source-publish.yml b/.github/workflows/reusable-package-source-publish.yml
index b75946e44e..f028a1869d 100644
--- a/.github/workflows/reusable-package-source-publish.yml
+++ b/.github/workflows/reusable-package-source-publish.yml
@@ -33,12 +33,12 @@ jobs:
     timeout-minutes: 1440
     steps:
       - name: Checkout package source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: package-source
 
       - name: Checkout Kandelo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ inputs.kandelo-repository }}
           ref: ${{ inputs.kandelo-ref }}
@@ -76,7 +76,7 @@ jobs:
           git -C kandelo submodule update --init --depth 1 musl
 
       - name: Cache Cargo and Kandelo sysroots
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/staging-build.yml b/.github/workflows/staging-build.yml
index 161599166c..f4e23d6a58 100644
--- a/.github/workflows/staging-build.yml
+++ b/.github/workflows/staging-build.yml
@@ -84,7 +84,7 @@ jobs:
       package_staging_reason: ${{ steps.route.outputs.package_staging_reason }}
       skip_staging_tests: ${{ steps.skip.outputs.skip_staging_tests }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -105,7 +105,7 @@ jobs:
         with:
           base-ref: origin/${{ github.event.pull_request.base.ref }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: abi-staging-authority
@@ -247,7 +247,7 @@ jobs:
       baseline_tag: ${{ steps.compute.outputs.baseline_tag }}
       reuse_staging: ${{ steps.compute.outputs.reuse_staging }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -268,7 +268,7 @@ jobs:
         run: bash scripts/dev-shell.sh true
 
       - name: Cache xtask build
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -603,7 +603,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
@@ -645,7 +645,7 @@ jobs:
         include: ${{ fromJSON(needs.preflight.outputs.library_matrix) }}
     steps:
       - id: checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -725,7 +725,7 @@ jobs:
         include: ${{ fromJSON(needs.preflight.outputs.program_matrix) }}
     steps:
       - id: checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -793,7 +793,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       GITHUB_REPOSITORY: ${{ github.repository }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -827,7 +827,7 @@ jobs:
       BINARY_MATERIALIZATION_CHANGED: ${{ needs.change-scope.outputs.binary_materialization_changed }}
       EXACT_ABI_STAGING_APPLICABLE: ${{ needs.change-scope.outputs.exact_abi_staging_applicable }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -930,7 +930,7 @@ jobs:
           fi
           echo "skip=false" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.suite.outputs.skip != 'true'
         with:
           ref: ${{ github.event.pull_request.head.sha }}
@@ -962,7 +962,7 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -1001,7 +1001,7 @@ jobs:
               -o host/test/fixtures/deep-wasm-recursion.wasm
           '
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: abi-staging-authority
@@ -1068,7 +1068,7 @@ jobs:
             route: sortix runtime
             submodules: tests/sortix/os-test
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -1097,7 +1097,7 @@ jobs:
           name: exact-abi-source-test-workspace
           path: ${{ runner.temp }}/exact-abi-source-test-workspace
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: abi-staging-authority
@@ -1204,7 +1204,7 @@ jobs:
       PACKAGE_REUSE_STAGING: ${{ needs.preflight.outputs.reuse_staging }}
       SKIP_STAGING_TESTS: ${{ needs.change-scope.outputs.skip_staging_tests }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -1536,7 +1536,7 @@ jobs:
           fi
           echo "skip=false" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.suite.outputs.skip != 'true'
         with:
           ref: ${{ github.event.pull_request.head.sha }}
@@ -1673,7 +1673,7 @@ jobs:
       TEST_SUITE_RESULT: ${{ needs.test-suite.result }}
       SKIP_STAGING_TESTS: ${{ needs.change-scope.outputs.skip_staging_tests }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: needs.change-scope.outputs.package_staging_required == 'true'
         with:
           ref: ${{ github.event.pull_request.head.sha }}
@@ -1938,7 +1938,7 @@ jobs:
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
diff --git a/.github/workflows/staging-cleanup.yml b/.github/workflows/staging-cleanup.yml
index bdf559a88d..2880a362ec 100644
--- a/.github/workflows/staging-cleanup.yml
+++ b/.github/workflows/staging-cleanup.yml
@@ -32,7 +32,7 @@ jobs:
         if: |
           github.event.pull_request.merged != true ||
           !contains(github.event.pull_request.labels.*.name, 'retain-package-staging')
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
@@ -139,7 +139,7 @@ jobs:
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           sparse-checkout: |