diff --git a/.github/workflows/prismpm.yml b/.github/workflows/prismpm.yml
index dcf2c9f..4d12b39 100644
--- a/.github/workflows/prismpm.yml
+++ b/.github/workflows/prismpm.yml
@@ -58,7 +58,7 @@ jobs:
       sdk-image: ${{ steps.lock.outputs.sdk-image }}
     steps:
       - name: Check out the exact event revision without credentials
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -87,7 +87,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the exact event revision without credentials
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -119,7 +119,7 @@ jobs:
       release-digest: ${{ steps.product.outputs.release-digest }}
     steps:
       - name: Check out the exact event revision without credentials
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -157,7 +157,7 @@ jobs:
           mkdir -p .prism/ci
           printf '%s' "$RESULT" > .prism/ci/build.json
       - name: Preserve the exact OCI graph and canonical result
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: prismpm-product-release
           if-no-files-found: error
@@ -194,12 +194,12 @@ jobs:
       immutable-reference: ${{ needs.build.outputs.immutable-reference }}
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Restore the build job's exact OCI graph
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: prismpm-product-release
           path: .prism
@@ -229,7 +229,7 @@ jobs:
           sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }}
           trusted-root: ${{ steps.policy.outputs.trusted-root-path }}
       - name: Authenticate to GHCR with the short-lived job token
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -255,12 +255,12 @@ jobs:
       plan-digest: ${{ steps.plan.outputs.plan-digest }}
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Authenticate for immutable release retrieval
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -286,7 +286,7 @@ jobs:
           sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }}
           target: ${{ inputs.target }}
       - name: Preserve the exact target-state-bound plan as inert data
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: prismpm-deployment-plan
           if-no-files-found: error
@@ -308,12 +308,12 @@ jobs:
       evidence-digest: ${{ steps.deploy.outputs.evidence-digest }}
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Authenticate for immutable release retrieval
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -331,7 +331,7 @@ jobs:
           reference: ${{ needs.promote.outputs.immutable-reference }}
           sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }}
       - name: Restore the exact plan produced against observed target state
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: prismpm-deployment-plan
           path: .prism/plans
@@ -351,7 +351,7 @@ jobs:
           reference: ${{ needs.promote.outputs.immutable-reference }}
           sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }}
       - name: Preserve target state for independent post-deployment verification
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: prismpm-deployment-state
           if-no-files-found: error
@@ -371,12 +371,12 @@ jobs:
       packages: read
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Authenticate for immutable release retrieval
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -394,7 +394,7 @@ jobs:
           reference: ${{ needs.promote.outputs.immutable-reference }}
           sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }}
       - name: Restore the deploy job's exact observed target state
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: prismpm-deployment-state
           path: .prism/targets
@@ -426,12 +426,12 @@ jobs:
       transcript-digest: ${{ steps.conformance.outputs.transcript-digest }}
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Authenticate for immutable release retrieval
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -456,7 +456,7 @@ jobs:
           reference: ${{ needs.promote.outputs.immutable-reference }}
           sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }}
       - name: Preserve the conformance-bearing graph for protected acceptance
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: prismpm-accepted-input
           if-no-files-found: error
@@ -477,18 +477,18 @@ jobs:
       packages: write
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Authenticate for the exact evidence-bearing release graph
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Restore the exact conformance-bearing graph without rebuilding
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: prismpm-accepted-input
           path: .prism
@@ -535,12 +535,12 @@ jobs:
       packages: read
     steps:
       - name: Check out the reviewed workflow revision
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Authenticate for immutable accepted-release retrieval
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/template-update.yml b/.github/workflows/template-update.yml
index fe747b9..90f19a0 100644
--- a/.github/workflows/template-update.yml
+++ b/.github/workflows/template-update.yml
@@ -27,13 +27,13 @@ jobs:
       contents: read
     steps:
       - name: Check out the protected downstream branch without credentials
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.event.repository.default_branch }}
       - name: Check out the exact reviewed template policy snapshot
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -125,7 +125,7 @@ jobs:
           git diff --binary >.template-update.patch
           test -s .template-update.patch
       - name: Preserve the inert reviewable patch
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: template-update-proposal
           if-no-files-found: error
@@ -143,13 +143,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out the protected default branch without persisted credentials
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.event.repository.default_branch }}
       - name: Restore and apply the inert proposal
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: template-update-proposal
       - name: Validate and apply the proposed patch without executing it
@@ -158,7 +158,7 @@ jobs:
           git apply .template-update.patch
           rm .template-update.patch
       - name: Open the patch as a pull request
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
         with:
           branch: automation/template-contract-update
           commit-message: "chore: update locked UOR template contract"