diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index cfb50a1..0f3d79a 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/build-push.yaml b/.github/workflows/build-push.yaml
index 04b1aed..2418021 100644
--- a/.github/workflows/build-push.yaml
+++ b/.github/workflows/build-push.yaml
@@ -220,7 +220,7 @@ jobs:
             fi
           } >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false
@@ -263,7 +263,7 @@ jobs:
             echo "file=$dockerfile"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: libops/.github
           ref: f872de10579c17155eb0a0c581d9ac7088b2f836
@@ -315,7 +315,7 @@ jobs:
 
       - name: GHCR Login
         if: steps.registry.outputs.primary-kind == 'ghcr'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -335,7 +335,7 @@ jobs:
 
       - name: Primary GAR Login
         if: steps.registry.outputs.primary-kind == 'gar'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ steps.registry.outputs.primary-host }}
           username: oauth2accesstoken
@@ -343,17 +343,17 @@ jobs:
 
       - name: Docker Hub Login
         if: steps.registry.outputs.primary-kind == 'dockerhub'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: build+push
         id: push-direct
         if: ${{ !inputs.scan && inputs.additional-gar-registry == '' && inputs.expected-main-sha == '' && steps.registry.outputs.has-aliases != 'true' }}
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ${{ steps.paths.outputs.context }}
           file: ${{ steps.paths.outputs.file }}
@@ -369,7 +369,7 @@ jobs:
 
       - name: Build native image for verified publication
         if: ${{ inputs.scan || inputs.additional-gar-registry != '' || inputs.expected-main-sha != '' || steps.registry.outputs.has-aliases == 'true' }}
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ${{ steps.paths.outputs.context }}
           file: ${{ steps.paths.outputs.file }}
@@ -421,7 +421,7 @@ jobs:
 
       - name: Additional GAR Login
         if: inputs.additional-gar-registry != ''
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ steps.registry.outputs.additional-host }}
           username: oauth2accesstoken
@@ -552,7 +552,7 @@ jobs:
 
       - name: GHCR Login
         if: steps.registry.outputs.primary-kind == 'ghcr'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -571,7 +571,7 @@ jobs:
 
       - name: Primary GAR Login
         if: steps.registry.outputs.primary-kind == 'gar'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ steps.registry.outputs.primary-host }}
           username: oauth2accesstoken
@@ -579,7 +579,7 @@ jobs:
 
       - name: Docker Hub Login
         if: steps.registry.outputs.primary-kind == 'dockerhub'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -596,13 +596,13 @@ jobs:
 
       - name: Additional GAR Login
         if: inputs.additional-gar-registry != ''
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ steps.registry.outputs.additional-host }}
           username: oauth2accesstoken
           password: ${{ steps.auth-primary.outputs.access_token || steps.auth-additional.outputs.access_token }}
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: libops/.github
           ref: f872de10579c17155eb0a0c581d9ac7088b2f836
@@ -647,7 +647,7 @@ jobs:
             fi
           } >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Install Cosign
         if: inputs.sign
@@ -936,7 +936,7 @@ jobs:
     # not turn an already verified publication into a failed release rerun.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         if: needs.merge.result == 'success'
         with:
           repository: libops/.github
diff --git a/.github/workflows/bump-release.yaml b/.github/workflows/bump-release.yaml
index 821ec41..594b09e 100644
--- a/.github/workflows/bump-release.yaml
+++ b/.github/workflows/bump-release.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: "actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8" # v6
+        uses: "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803" # v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/sitectl-create-smoke-test.yaml b/.github/workflows/sitectl-create-smoke-test.yaml
index 1d5fa25..eee68af 100644
--- a/.github/workflows/sitectl-create-smoke-test.yaml
+++ b/.github/workflows/sitectl-create-smoke-test.yaml
@@ -136,7 +136,7 @@ jobs:
       GITHUB_ACTIONS: "true"
     steps:
       - name: Checkout caller repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           path: ${{ inputs.checkout-path }}
 
@@ -160,7 +160,7 @@ jobs:
 
       - name: Checkout local plugin source
         if: ${{ inputs.local-plugin-repository != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: ${{ inputs.local-plugin-repository }}
           ref: ${{ inputs.local-plugin-ref }}
@@ -332,7 +332,7 @@ jobs:
 
       - name: Checkout sitectl source
         if: ${{ inputs.sitectl-repository != '' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: ${{ inputs.sitectl-repository }}
           ref: ${{ inputs.sitectl-ref }}
@@ -341,7 +341,7 @@ jobs:
       - name: Install sitectl
         # Release this workflow only after advancing this SHA to the commit that
         # contains the package-versions contract in install-sitectl.
-        uses: libops/.github/.github/actions/install-sitectl@90a9272d0829c878a682ba636bc155c2b06c7939 # main
+        uses: libops/.github/.github/actions/install-sitectl@5f44a8c8d157bb7e5cf6d9e1c98847a604e87455 # main
         with:
           packages: ${{ steps.smoke.outputs.packages }}
           package-versions: ${{ inputs.package-versions }}
@@ -349,7 +349,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ inputs.local-plugin-path != '' || inputs.sitectl-repository != '' }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: ${{ inputs.go-version }}
           cache-dependency-path: ${{ steps.smoke.outputs.go-cache-dependency-path }}
diff --git a/.github/workflows/sitectl-plugin-goreleaser.yaml b/.github/workflows/sitectl-plugin-goreleaser.yaml
index 516a380..43ece39 100644
--- a/.github/workflows/sitectl-plugin-goreleaser.yaml
+++ b/.github/workflows/sitectl-plugin-goreleaser.yaml
@@ -155,7 +155,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Checkout release source
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
           ref: refs/tags/${{ steps.validate_full.outputs.version }}
@@ -203,7 +203,7 @@ jobs:
           fi
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: ${{ inputs.go-version }}
 
@@ -302,7 +302,7 @@ jobs:
           fi
 
       - name: Checkout exact package publisher
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: libops/terraform-linux-packages
           ref: b14fd2f95b4017e897c595b3321b9cc3f48b5ddd # main