diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index e2e9df3b..60e83b07 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -35,10 +35,10 @@ workflows:
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/inbox-steward.yml':
         - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43'
+        - 'step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
-        - 'step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43'
+        - 'step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/learning-loop.yml':
@@ -57,7 +57,7 @@ workflows:
         - 'swatinem/rust-cache@v2.9.3'
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.5.1'
-        - 'step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43'
+        - 'step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a'
     '.github/workflows/repo-integrity-guard.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust.yml':
@@ -66,7 +66,7 @@ workflows:
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/supervised-fleet-scan.yml':
         - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43'
+        - 'step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a'
     '.github/workflows/vendored-bot-drift.yml':
         - 'actions/checkout@v7.0.1'
 dependencies:
@@ -167,9 +167,9 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
-    'step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43':
-        ref: 'v2.22.3'
-        commit: 'sha1-46b06cea07f9e64621fdf066ba77ac6915163d43'
+    'step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a':
+        ref: 'v2.22.4'
+        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
         owner_id: 88700172
         repo_id: 422287306
     'swatinem/rust-cache@v2.9.3':
diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml
index 83de4dc9..671b8f2f 100644
--- a/.github/workflows/inbox-steward.yml
+++ b/.github/workflows/inbox-steward.yml
@@ -394,7 +394,7 @@ jobs:
     
     steps:
       - name: Harden credential-bearing runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a
         with:
           egress-policy: block
           disable-telemetry: true
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 26e59f2b..b6872283 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -28,7 +28,7 @@ jobs:
       HAS_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN != '' }}
     steps:
       - name: Harden credential-bearing runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a
         with:
           egress-policy: block
           disable-telemetry: true
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 7fb54727..239d88a1 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Harden credential-bearing runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a
         with:
           egress-policy: block
           disable-telemetry: true
diff --git a/.github/workflows/supervised-fleet-scan.yml b/.github/workflows/supervised-fleet-scan.yml
index 740a6c6e..99310a0b 100644
--- a/.github/workflows/supervised-fleet-scan.yml
+++ b/.github/workflows/supervised-fleet-scan.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden credential-bearing runner
-        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a
         with:
           egress-policy: audit
           # Scheduled fleet scans contact rule-specific services; audit the