diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7d45ea77..b5e49600 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -44,8 +44,3 @@ updates:
         update-types:
           - "minor"
           - "patch"
-    ignore:
-      # v1.12 hangs after the codex turn completes (openai/codex-action#150);
-      # drop this once the action-side fix (openai/codex-action#151) is released.
-      - dependency-name: "openai/codex-action"
-        versions: ["1.12"]
diff --git a/.github/workflows/ai_pr_review.yml b/.github/workflows/ai_pr_review.yml
index fa64a94b..3a79ae92 100644
--- a/.github/workflows/ai_pr_review.yml
+++ b/.github/workflows/ai_pr_review.yml
@@ -515,9 +515,10 @@ jobs:
       - name: Run Codex
         id: run_codex
         if: steps.pr.outputs.is_fork == 'false'
-        # Pinned to v1.11: v1.12 hangs after the turn completes
-        # (openai/codex-action#150); re-bump once #151 ships.
-        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1.11
+        # v1.12 hung after heavy turns (openai/codex-action#150); the fix
+        # landed CLI-side in Codex 0.150.0, which the codex-version pin
+        # below already exceeds. v1.13 also bounds post-exit output draining.
+        uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1.13
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           prompt-file: .github/codex/prompts/pr_review_compiled.md
diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index 3212ce72..149d8749 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -67,7 +67,7 @@ jobs:
           fi
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: ${{ matrix.artifact }}
           path: dist/*.whl
@@ -101,7 +101,7 @@ jobs:
         run: maturin build --release --out dist --features extension-module,accelerate
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: wheels-macos-arm64-py${{ matrix.python-version }}
           path: dist/*.whl
@@ -134,7 +134,7 @@ jobs:
         run: maturin build --release --out dist --features extension-module
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: wheels-windows-py${{ matrix.python-version }}
           path: dist/*.whl
@@ -159,7 +159,7 @@ jobs:
         run: maturin sdist --out dist
 
       - name: Upload sdist
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sdist
           path: dist/*.tar.gz
diff --git a/.github/workflows/docs-tests.yml b/.github/workflows/docs-tests.yml
index 6e6e068e..5357cc28 100644
--- a/.github/workflows/docs-tests.yml
+++ b/.github/workflows/docs-tests.yml
@@ -204,7 +204,7 @@ jobs:
           grep -q 'htmlToText' docs/_build/html/_static/searchtools.js
 
       - name: Set up Node for the search smoke test
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # Current LTS; jsdom's floor is far below this. Pinned so the
           # smoke test doesn't float with the runner image default.
diff --git a/.github/workflows/notebooks.yml b/.github/workflows/notebooks.yml
index d2e268db..ab16ed72 100644
--- a/.github/workflows/notebooks.yml
+++ b/.github/workflows/notebooks.yml
@@ -98,7 +98,7 @@ jobs:
 
       - name: Upload failed notebook outputs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: failed-notebook-outputs
           path: docs/tutorials/*.ipynb
@@ -154,7 +154,7 @@ jobs:
 
       - name: Upload failed notebook outputs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: failed-interop-notebook-outputs
           path: docs/tutorials/26_composition_drift_calibration.ipynb
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ceced767..ab6523e5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           path: dist
           merge-multiple: true