diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5ccf94a..681befd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,16 +30,16 @@ jobs:
         with:
           fetch-depth: 0 # needs-release/calver read tags and history
       - id: gate
-        uses: metio/ci/needs-release@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
+        uses: metio/ci/needs-release@3529dd5a30dd5739b2d80c2acc8882a951760b53 # 2026.8.22144013
         with:
           paths: action.yml
       - id: version
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/calver@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
+        uses: metio/ci/calver@3529dd5a30dd5739b2d80c2acc8882a951760b53 # 2026.8.22144013
       - id: notes
         name: Generate release notes
         if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/release-notes@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
+        uses: metio/ci/release-notes@3529dd5a30dd5739b2d80c2acc8882a951760b53 # 2026.8.22144013
         with:
           version: ${{ steps.version.outputs.version }}
           previous: ${{ steps.gate.outputs.last }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index ed459fe..e1be30f 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: metio/ci/policy-check@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # 2026.8.4134806
+      - uses: metio/ci/policy-check@3529dd5a30dd5739b2d80c2acc8882a951760b53 # 2026.8.22144013
   dco:
     # Developer Certificate of Origin: every commit carries a Signed-off-by
     # trailer. Bot PRs skip; a skipped job still satisfies the gate below.
@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: metio/ci/dco@6ccbfec6667dbf259d07ae33159592fb80f4aba2 # main
+      - uses: metio/ci/dco@3529dd5a30dd5739b2d80c2acc8882a951760b53 # main
   verify:
     # Single required check: mark only this one required in branch protection and
     # new jobs are covered automatically.