diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a6843ad..2101a27 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git,npm
 
@@ -63,13 +63,13 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
 
       - name: Verify the playground Composer configuration
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           working-directory: playground/php-runtime
 
@@ -159,7 +159,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git
 
@@ -172,7 +172,7 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           working-directory: microservice
 
@@ -213,7 +213,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Bootstrap patched pip trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
       - run: 'python -m pip install --only-binary :all: PyYAML==6.0.2'
       - name: Require centrally approved immutable action commits
         run: >-
diff --git a/.github/workflows/composer-lock-audit.yml b/.github/workflows/composer-lock-audit.yml
index 9f1c2d9..81ccc57 100644
--- a/.github/workflows/composer-lock-audit.yml
+++ b/.github/workflows/composer-lock-audit.yml
@@ -44,7 +44,7 @@ jobs:
           python-version: '3.13'
 
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git,npm
 
@@ -56,7 +56,7 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before advisory requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
 
       - name: Audit the committed lock inventory
         run: bash scripts/ci/audit-committed-composer-locks.sh
diff --git a/.github/workflows/devcontainer-image.yml b/.github/workflows/devcontainer-image.yml
index f54e19c..3d66def 100644
--- a/.github/workflows/devcontainer-image.yml
+++ b/.github/workflows/devcontainer-image.yml
@@ -57,13 +57,13 @@ jobs:
           echo '2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576  .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh' | sha256sum --check --strict
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Sign in to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Sign in to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           username: durableworkflow
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -103,13 +103,13 @@ jobs:
     steps:
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Sign in to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Sign in to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           username: durableworkflow
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -210,13 +210,13 @@ jobs:
           persist-credentials: false
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Sign in to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Sign in to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           username: durableworkflow
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/playground-journeys.yml b/.github/workflows/playground-journeys.yml
index 3cd974c..1918df5 100644
--- a/.github/workflows/playground-journeys.yml
+++ b/.github/workflows/playground-journeys.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git
 
@@ -43,10 +43,10 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
 
       - name: Verify the playground Composer configuration
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           working-directory: playground/php-runtime
 
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index b8a7da9..fe85847 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
+      - uses: SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65 # v8.4.1
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
diff --git a/tests/Unit/DevcontainerImageContractTest.php b/tests/Unit/DevcontainerImageContractTest.php
index f79df3e..3e5321e 100644
--- a/tests/Unit/DevcontainerImageContractTest.php
+++ b/tests/Unit/DevcontainerImageContractTest.php
@@ -125,7 +125,7 @@ public function test_composer_jobs_check_trust_before_dependency_resolution(): v
             foreach ($steps as $index => $step) {
                 if (str_starts_with($step['uses'] ?? '', 'durable-workflow/.github/.github/actions/bootstrap-patched-pip@')) {
                     $bootstrap = $index;
-                    $this->assertSame('76f333804e68725059039fd54df241d40d855cd3', explode('@', $step['uses'])[1]);
+                    $this->assertSame('52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2', explode('@', $step['uses'])[1]);
                     $this->assertStringContainsString('composer,curl,git', $step['with']['clients']);
                 }
                 if (str_starts_with($step['uses'] ?? '', 'shivammathur/setup-php@')) {
@@ -138,7 +138,7 @@ public function test_composer_jobs_check_trust_before_dependency_resolution(): v
             $this->assertLessThan($setup, $bootstrap);
             $this->assertSame('composer:2.10.3', $steps[$setup]['with']['tools']);
             $this->assertSame(
-                'durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3',
+                'durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2',
                 $steps[$setup + 1]['uses'],
             );
             $this->assertSame($job === 'microservice-test' ? 'microservice' : '.', $steps[$setup + 1]['with']['working-directory'] ?? '.');