diff --git a/.github/workflows/assistant-live.yml b/.github/workflows/assistant-live.yml
index fbf1bd6..fb77e84 100644
--- a/.github/workflows/assistant-live.yml
+++ b/.github/workflows/assistant-live.yml
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: landing-zone-configurator/app/.node-version
           cache: npm
@@ -78,7 +78,7 @@ jobs:
           node --use-system-ca --import tsx scripts/assistant-journey.ts | tee assistant-journey-results.jsonl
       - name: Upload synthetic results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: assistant-live-results
           path: |
diff --git a/.github/workflows/configurator-bootstrap.yml b/.github/workflows/configurator-bootstrap.yml
index 42b9420..e58c435 100644
--- a/.github/workflows/configurator-bootstrap.yml
+++ b/.github/workflows/configurator-bootstrap.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -84,7 +84,7 @@ jobs:
       - name: Bind encrypted plan to commit and workflow run
         run: node infra/ci/review.mjs seal
       - name: Upload encrypted plan
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bootstrap-plan-${{ github.run_id }}
           path: |
@@ -110,7 +110,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -148,7 +148,7 @@ jobs:
         run: tofu -chdir="infra/$LZC_ROOT" init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/$LZC_ROOT.backend.hcl"
       - name: OpenTofu validate
         run: tofu -chdir="infra/$LZC_ROOT" validate -no-color
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bootstrap-plan-${{ github.run_id }}
           path: landing-zone-configurator/.local/ci-plan
@@ -173,7 +173,7 @@ jobs:
           node infra/ci/protect-state.mjs
       - name: Upload encrypted recovery state
         if: always() && steps.apply.outcome != '' && steps.apply.outcome != 'skipped'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bootstrap-state-${{ github.run_id }}
           path: landing-zone-configurator/.local/ci-recovery/*.enc.json
diff --git a/.github/workflows/configurator-platform.yml b/.github/workflows/configurator-platform.yml
index fb258ec..d64e51f 100644
--- a/.github/workflows/configurator-platform.yml
+++ b/.github/workflows/configurator-platform.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -94,7 +94,7 @@ jobs:
       - name: Bind encrypted plan to commit and workflow run
         run: node infra/ci/review.mjs seal
       - name: Upload encrypted plan
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: platform-plan-${{ github.run_id }}
           path: |
@@ -120,7 +120,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -167,7 +167,7 @@ jobs:
         run: tofu -chdir="infra/$LZC_ROOT" init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/$LZC_ROOT.backend.hcl"
       - name: OpenTofu validate
         run: tofu -chdir="infra/$LZC_ROOT" validate -no-color
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: platform-plan-${{ github.run_id }}
           path: landing-zone-configurator/.local/ci-plan
@@ -192,7 +192,7 @@ jobs:
           node infra/ci/protect-state.mjs
       - name: Upload encrypted recovery state
         if: always() && steps.apply.outcome != '' && steps.apply.outcome != 'skipped'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: platform-state-${{ github.run_id }}
           path: landing-zone-configurator/.local/ci-recovery/*.enc.json
diff --git a/.github/workflows/configurator-release.yml b/.github/workflows/configurator-release.yml
index 5db0956..6b5d51c 100644
--- a/.github/workflows/configurator-release.yml
+++ b/.github/workflows/configurator-release.yml
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
           cache: npm
@@ -71,7 +71,7 @@ jobs:
         run: npm run test:database -- --maxWorkers=2 --testTimeout=30000
         env:
           LZC_TEST_DATABASE_URL: postgres://postgres:lzc-test-only@127.0.0.1:5432/configurator_test
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.27.1'
           cache-dependency-path: landing-zone-configurator/tools/hcl-adapter/go.sum
@@ -120,7 +120,7 @@ jobs:
           node ../infra/ci/release-artifact.mjs create ../.local
           tar -czf ../.local/configurator-release.tar.gz -C ../.local release.tar.gz release.sha256 runner.tar.gz runner.sha256 release-manifest.json
           (cd ../.local && sha256sum configurator-release.tar.gz > configurator-release.sha256)
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: configurator-release-${{ github.run_id }}
           path: |
@@ -146,7 +146,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - name: Resolve successful immutable release build
@@ -194,7 +194,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -237,7 +237,7 @@ jobs:
           tar -xzf "$RUNNER_TEMP/cf.tgz" -C "$RUNNER_TEMP/cf-bin" cf8
           ln -s cf8 "$RUNNER_TEMP/cf-bin/cf"
           echo "$RUNNER_TEMP/cf-bin" >> "$GITHUB_PATH"
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ steps.source.outputs.artifact_id }}
           run-id: ${{ steps.source.outputs.release_run_id }}
diff --git a/.github/workflows/configurator-runtime.yml b/.github/workflows/configurator-runtime.yml
index cdd6664..f3f30d1 100644
--- a/.github/workflows/configurator-runtime.yml
+++ b/.github/workflows/configurator-runtime.yml
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -104,7 +104,7 @@ jobs:
       - name: Bind encrypted plan to commit and workflow run
         run: node infra/ci/review.mjs seal
       - name: Upload encrypted plan
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: runtime-plan-${{ github.run_id }}
           path: |
@@ -130,7 +130,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
@@ -188,7 +188,7 @@ jobs:
         run: tofu -chdir="infra/$LZC_ROOT" init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/$LZC_ROOT.backend.hcl"
       - name: OpenTofu validate
         run: tofu -chdir="infra/$LZC_ROOT" validate -no-color
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: runtime-plan-${{ github.run_id }}
           path: landing-zone-configurator/.local/ci-plan
@@ -213,7 +213,7 @@ jobs:
           node infra/ci/protect-state.mjs
       - name: Upload encrypted recovery state
         if: always() && steps.apply.outcome != '' && steps.apply.outcome != 'skipped'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: runtime-state-${{ github.run_id }}
           path: landing-zone-configurator/.local/ci-recovery/*.enc.json
diff --git a/.github/workflows/validate-configurator.yml b/.github/workflows/validate-configurator.yml
index 23bece9..310f6f4 100644
--- a/.github/workflows/validate-configurator.yml
+++ b/.github/workflows/validate-configurator.yml
@@ -42,11 +42,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.27.1'
           cache-dependency-path: landing-zone-configurator/tools/hcl-adapter/go.sum
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.21.0'
       - name: Build shared model for native HCL round-trip tests
@@ -84,7 +84,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: landing-zone-configurator/app/.node-version
           cache: npm
@@ -115,7 +115,7 @@ jobs:
         run: npm run test:e2e
       - name: Upload UI evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: configurator-ui-evidence
           path: landing-zone-configurator/.local/browser-tests
@@ -139,7 +139,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: landing-zone-configurator/app/.node-version
       - name: Setup OpenTofu
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index f4f2e92..3f1dd26 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -90,7 +90,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup TFLint
-        uses: terraform-linters/setup-tflint@1cf010d3c7aef302051ccdb68c14c5dc2efa34ef # v6.3.1
+        uses: terraform-linters/setup-tflint@6ffdbaa3be476b3431f7275c26966ef32ff60337 # v6.3.2
         with:
           tflint_version: ${{ env.TFLINT_VERSION }}