diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml
index 434fd71..dc3b2b5 100644
--- a/.github/workflows/callable-dependency-review.yaml
+++ b/.github/workflows/callable-dependency-review.yaml
@@ -16,7 +16,7 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index ebc7e03..b84537b 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -70,9 +70,9 @@ jobs:
       group: cd-cdk-${{ inputs.region }}-${{ inputs.stacks }}-${{ inputs.stack-name }}
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         if: ${{ inputs.enable-qemu }}
 
       - uses: actions/setup-dotnet@v6
@@ -121,7 +121,7 @@ jobs:
             pip install -r "$req"
           done < <(find . -name requirements.txt -not -path '*/node_modules/*' -print0)
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-dotnet-eb.yaml b/.github/workflows/cd-dotnet-eb.yaml
index 3e9d70c..bad2939 100644
--- a/.github/workflows/cd-dotnet-eb.yaml
+++ b/.github/workflows/cd-dotnet-eb.yaml
@@ -82,7 +82,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-dotnet@v6
         with:
@@ -119,7 +119,7 @@ jobs:
           cd ..
           echo "Bundle size: $(du -h bundle.zip | cut -f1)"
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml
index 39db5c6..df79a2b 100644
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@@ -69,9 +69,9 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
@@ -82,7 +82,7 @@ jobs:
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true
diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml
index b6b8b56..2b776a5 100644
--- a/.github/workflows/cd-sam.yaml
+++ b/.github/workflows/cd-sam.yaml
@@ -49,7 +49,7 @@ jobs:
       group: cd-sam-${{ inputs.region }}-${{ inputs.stack-name }}
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v7
         with:
@@ -57,7 +57,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/ci-dotnet.yaml b/.github/workflows/ci-dotnet.yaml
index 427a470..15c9201 100644
--- a/.github/workflows/ci-dotnet.yaml
+++ b/.github/workflows/ci-dotnet.yaml
@@ -34,7 +34,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-dotnet@v6
         with:
diff --git a/.github/workflows/ci-mobile-ios.yaml b/.github/workflows/ci-mobile-ios.yaml
index 8c31458..d51b776 100644
--- a/.github/workflows/ci-mobile-ios.yaml
+++ b/.github/workflows/ci-mobile-ios.yaml
@@ -137,7 +137,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -206,7 +206,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -214,7 +214,7 @@ jobs:
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true
diff --git a/.github/workflows/ci-python-app.yaml b/.github/workflows/ci-python-app.yaml
index cbf58b4..7006257 100644
--- a/.github/workflows/ci-python-app.yaml
+++ b/.github/workflows/ci-python-app.yaml
@@ -60,7 +60,7 @@ jobs:
       group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-lint
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v7
         with:
@@ -109,7 +109,7 @@ jobs:
       group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-test-collect
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v7
         with:
@@ -133,7 +133,7 @@ jobs:
       group: ci-python-app-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}-subproject-tests
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v7
         with:
diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index ac35356..29a752e 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -55,7 +55,7 @@ jobs:
       group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-python@v7
         with:
@@ -95,7 +95,7 @@ jobs:
 
       - name: Set up QEMU
         if: ${{ inputs.run-cdk-synth && inputs.enable-qemu }}
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: CDK synth
         if: ${{ inputs.run-cdk-synth }}
diff --git a/.github/workflows/ci-static.yaml b/.github/workflows/ci-static.yaml
index e203970..3e85a60 100644
--- a/.github/workflows/ci-static.yaml
+++ b/.github/workflows/ci-static.yaml
@@ -70,7 +70,7 @@ jobs:
       CHECK_DIR: ${{ inputs.check-dir }}
       BUILD_COMMAND: ${{ inputs.build-command }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         if: ${{ inputs.run-htmlhint || inputs.build-command != '' }}
diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml
index dc96a74..bf494aa 100644
--- a/.github/workflows/ci-typescript-cdk.yaml
+++ b/.github/workflows/ci-typescript-cdk.yaml
@@ -67,9 +67,9 @@ jobs:
       group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         if: ${{ inputs.enable-qemu }}
 
       - uses: actions/setup-dotnet@v6
diff --git a/.github/workflows/ci-typescript-frontend.yaml b/.github/workflows/ci-typescript-frontend.yaml
index fa72813..a96d9a6 100644
--- a/.github/workflows/ci-typescript-frontend.yaml
+++ b/.github/workflows/ci-typescript-frontend.yaml
@@ -87,7 +87,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release-on-merge.yaml b/.github/workflows/release-on-merge.yaml
index 0f79cc1..b2df093 100644
--- a/.github/workflows/release-on-merge.yaml
+++ b/.github/workflows/release-on-merge.yaml
@@ -59,7 +59,7 @@ jobs:
     outputs:
       version: ${{ steps.next.outputs.version }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           # Tags are the input to the version calculation, so they must be
           # fetched; a shallow checkout without them would restart at 1.0.0.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e1eba01..bbac516 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -118,7 +118,7 @@ jobs:
       released: ${{ steps.publish.outputs.released || 'false' }}
       url: ${{ steps.publish.outputs.url }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           # Full history + tags: the existing-tag guard reads local refs.
           fetch-depth: 0
diff --git a/workflow-templates/cdk-deploy.yml b/workflow-templates/cdk-deploy.yml
index 0afa2ba..9a46127 100644
--- a/workflow-templates/cdk-deploy.yml
+++ b/workflow-templates/cdk-deploy.yml
@@ -5,7 +5,7 @@ on:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
       # reusable workflow's default — passed explicitly to pin against drift.
diff --git a/workflow-templates/ci-dotnet.yml b/workflow-templates/ci-dotnet.yml
index 9032510..229dd47 100644
--- a/workflow-templates/ci-dotnet.yml
+++ b/workflow-templates/ci-dotnet.yml
@@ -12,4 +12,4 @@ jobs:
     # Every input is optional. Common overrides: `solution` (defaults to *.sln
     # in the working directory), `working-directory`, and `dotnet-version`
     # (defaults to 8.0.x). This reusable has no `node-version` input.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
diff --git a/workflow-templates/ci-mobile-ios.yml b/workflow-templates/ci-mobile-ios.yml
index ae929c5..6556e3c 100644
--- a/workflow-templates/ci-mobile-ios.yml
+++ b/workflow-templates/ci-mobile-ios.yml
@@ -8,7 +8,7 @@ jobs:
   ci:
     # Job id MUST stay `ci`: the reusable's aggregator job is also `ci`, so the
     # check context resolves to the required `ci / ci`.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-mobile-ios.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-mobile-ios.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also
       # the reusable workflow's default — passed explicitly to pin against drift.
diff --git a/workflow-templates/ci-node.yml b/workflow-templates/ci-node.yml
index 1a31874..1780193 100644
--- a/workflow-templates/ci-node.yml
+++ b/workflow-templates/ci-node.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
       # reusable workflow's default — passed explicitly to pin against drift.
diff --git a/workflow-templates/ci-python-app.yml b/workflow-templates/ci-python-app.yml
index 3f4a49d..7cb9677 100644
--- a/workflow-templates/ci-python-app.yml
+++ b/workflow-templates/ci-python-app.yml
@@ -12,4 +12,4 @@ jobs:
     # Every input is optional. Common overrides: `source-dirs` (ruff targets),
     # `requirements` (non-default requirements file), `subproject-dir` (a
     # self-contained suite that must run in its own working directory).
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
diff --git a/workflow-templates/ci-python.yml b/workflow-templates/ci-python.yml
index 3f347ce..5a9a979 100644
--- a/workflow-templates/ci-python.yml
+++ b/workflow-templates/ci-python.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       run-tests: true
       # ci-python-sam.yaml declares a `node-version` input (default "24") that
diff --git a/workflow-templates/ci-static.yml b/workflow-templates/ci-static.yml
index c1f6f36..7971e72 100644
--- a/workflow-templates/ci-static.yml
+++ b/workflow-templates/ci-static.yml
@@ -8,7 +8,7 @@ jobs:
   ci:
     # Job id MUST stay `ci`: the reusable's job is also `ci`, so the check
     # context resolves to the required `ci / ci`.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-static.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-static.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Pinned explicitly (handbook): local dev is Node 24 / npm 11, which
       # generates lockfileVersion 3. Being explicit avoids lockfile drift.
diff --git a/workflow-templates/ci-typescript-frontend.yml b/workflow-templates/ci-typescript-frontend.yml
index 1f27af9..caf3db3 100644
--- a/workflow-templates/ci-typescript-frontend.yml
+++ b/workflow-templates/ci-typescript-frontend.yml
@@ -8,7 +8,7 @@ jobs:
   ci:
     # Job id MUST stay `ci`: the reusable's job is also `ci`, so the check
     # context resolves to the required `ci / ci`.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Pinned explicitly (handbook): local dev is Node 24 / npm 11, which
       # generates lockfileVersion 3. Being explicit avoids lockfile drift.
diff --git a/workflow-templates/dependency-review.yml b/workflow-templates/dependency-review.yml
index 8c06587..0d381eb 100644
--- a/workflow-templates/dependency-review.yml
+++ b/workflow-templates/dependency-review.yml
@@ -8,4 +8,4 @@ permissions:
 
 jobs:
   dependency-review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
diff --git a/workflow-templates/dotnet-eb-deploy.yml b/workflow-templates/dotnet-eb-deploy.yml
index b2db872..ba2459f 100644
--- a/workflow-templates/dotnet-eb-deploy.yml
+++ b/workflow-templates/dotnet-eb-deploy.yml
@@ -5,7 +5,7 @@ on:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-dotnet-eb.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-dotnet-eb.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Required: the project to publish, relative to the repo root.
       project: REPLACE-ME-project-csproj
diff --git a/workflow-templates/labeler.yml b/workflow-templates/labeler.yml
index 217f89b..29e2715 100644
--- a/workflow-templates/labeler.yml
+++ b/workflow-templates/labeler.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
diff --git a/workflow-templates/mobile-ios-deploy.yml b/workflow-templates/mobile-ios-deploy.yml
index 95759f4..bb9f03c 100644
--- a/workflow-templates/mobile-ios-deploy.yml
+++ b/workflow-templates/mobile-ios-deploy.yml
@@ -5,7 +5,7 @@ on:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Pinned explicitly (handbook): local dev is Node 24 / npm 11, which
       # generates lockfileVersion 3. Being explicit avoids lockfile drift.
diff --git a/workflow-templates/release.yml b/workflow-templates/release.yml
index b0c52ee..1fb8b57 100644
--- a/workflow-templates/release.yml
+++ b/workflow-templates/release.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   release:
-    uses: Sea-Haven-Industries/.github/.github/workflows/release.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/release.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       version: ${{ inputs.version }}
       # Tags in this org are v-prefixed MAJOR.MINOR.PATCH; "v" is the default
diff --git a/workflow-templates/sam-deploy.yml b/workflow-templates/sam-deploy.yml
index 54a8deb..e022a69 100644
--- a/workflow-templates/sam-deploy.yml
+++ b/workflow-templates/sam-deploy.yml
@@ -5,7 +5,7 @@ on:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@81cf168170f356d1423d7736f7ce93fd6611ad53 # v1.0.4
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       # Required: the CloudFormation stack name (kebab-case, matches repo name).
       # NOTE: this is a literal placeholder on purpose — starter-workflow variables