diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 6cf1db3..ad6d8f3 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload immutable image identity
         if: github.event_name != 'pull_request'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: image-release-${{ github.sha }}
           path: image-release.json
diff --git a/.github/workflows/graph-pages.yml b/.github/workflows/graph-pages.yml
index 590a01e..819fd82 100644
--- a/.github/workflows/graph-pages.yml
+++ b/.github/workflows/graph-pages.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: '0.12.0'
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 076d578..ccee69c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -84,7 +84,7 @@ jobs:
 
       - name: Upload Trivy result
         if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: trivy-${{ github.sha }}
           path: trivy-results-*.json
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 75a7e76..2b81d5a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -22,12 +22,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: '0.10.9'
 
@@ -57,7 +57,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Mirror the runtime version shipped in the Docker image.
           python-version: '3.11'
@@ -104,7 +104,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
           cache: pip
@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Mirror the runtime version shipped in the Docker image.
           python-version: '3.11'
@@ -155,7 +155,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'
           cache: pip
@@ -168,7 +168,7 @@ jobs:
           python -m pip install --require-hashes -r requirements-test.txt
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -190,7 +190,7 @@ jobs:
 
       - name: Upload browser failure evidence
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: browser-e2e-failure
           path: test-results/
diff --git a/tests/test_supply_chain_policy.py b/tests/test_supply_chain_policy.py
index aa67a39..cec9a14 100644
--- a/tests/test_supply_chain_policy.py
+++ b/tests/test_supply_chain_policy.py
@@ -20,16 +20,16 @@
         'v5',
     ),
     'actions/setup-node': (
-        '249970729cb0ef3589644e2896645e5dc5ba9c38',
-        'v6',
+        '820762786026740c76f36085b0efc47a31fe5020',
+        'v7.0.0',
     ),
     'actions/setup-python': (
-        'ece7cb06caefa5fff74198d8649806c4678c61a1',
-        'v6',
+        '5fda3b95a4ea91299a34e894583c3862153e4b97',
+        'v7.0.0',
     ),
     'actions/upload-artifact': (
-        'ea165f8d65b6e75b540449e92b4886f43607fa02',
-        'v4',
+        '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a',
+        'v7.0.1',
     ),
     'actions/upload-pages-artifact': (
         'fc324d3547104276b827a68afc52ff2a11cc49c9',
@@ -44,7 +44,7 @@
         'v0.36.0',
     ),
     'astral-sh/setup-uv': (
-        '94527f2e458b27549849d47d273a16bec83a01e9',
+        '37802adc94f370d6bfd71619e3f0bf239e1f3b78',
         'v7',
     ),
     'docker/build-push-action': (