diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9d62a0e..59cb58a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,9 +21,9 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with: { java-version: '21', distribution: temurin }
-      - uses: github/codeql-action/init@v4.37.8
+      - uses: github/codeql-action/init@v4
         with: { languages: java, queries: +security-and-quality }
       - name: Build with Maven
         run: mvn --batch-mode --no-transfer-progress compile
-      - uses: github/codeql-action/analyze@v4.37.8
+      - uses: github/codeql-action/analyze@v4
         with: { category: "/language:java" }
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ee5bf0f..7709cb4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,10 +24,25 @@ on:
 #
 # cancel-in-progress is deliberately scoped to pull_request ONLY. A push to main or
 # to a v* tag is a release path: cancelling one midway could leave a partially
-# published set of artifacts, so those always run to completion even if another push
-# lands behind them.
+# published set of artifacts.
+#
+# cancel-in-progress: false is NOT sufficient on its own to protect a release run.
+# GitHub cancels a *pending* run whenever a newer run joins the same group behind an
+# in-progress one -- that rule is independent of cancel-in-progress. So with a plain
+# `workflow-ref` group, a queued `publish_to_central` dispatch on main could be
+# silently dropped by a later push to main, both sharing `Publish-refs/heads/main`.
+# Giving every non-PR run its own group (via the unique run_id) means such a run is
+# never queued behind a sibling and therefore can never be cancelled, while PR runs
+# still share a group per ref and supersede each other as intended.
+#
+# One-time effect when this expression changes: GitHub reads `concurrency` from the
+# workflow file at each run's own ref, so a run started before the change sits in the
+# old group and a run started after it sits in the new one. They are different groups,
+# so the new push does NOT supersede the in-flight old run -- exactly once, on the
+# commit that lands this. It self-heals from the next push on. Expect the same overlap
+# when porting this to a sibling repo; it is not a sign the expression is wrong.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'pull_request' && 'pr' || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
@@ -189,7 +204,7 @@ jobs:
         with:
           java-version: '21'
           distribution: temurin
-      - uses: gradle/actions/setup-gradle@v6.3.0
+      - uses: gradle/actions/setup-gradle@v6
         with:
           gradle-version: "9.6.1"
       - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index dfe8425..4f838ef 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -43,6 +43,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@v4.37.8
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: results.sarif
diff --git a/pom.xml b/pom.xml
index 968b04d..174d429 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,8 +34,8 @@ SPDX-License-Identifier: Apache-2.0
         <nullaway.version>0.14.0</nullaway.version>
         <jspecify.version>1.0.1</jspecify.version>
         <checker.version>4.2.2</checker.version>
-        <spotless.version>3.10.0</spotless.version>
-        <palantir-java-format.version>2.96.0</palantir-java-format.version>
+        <spotless.version>3.10.1</spotless.version>
+        <palantir-java-format.version>2.97.0</palantir-java-format.version>
         <spotbugs.version>4.10.4.0</spotbugs.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
@@ -318,7 +318,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.pitest</groupId>
                     <artifactId>pitest-maven</artifactId>
-                    <version>1.25.9</version>
+                    <version>1.30.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonatype.central</groupId>