diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index 82d1d21..a7734bc 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -62,7 +62,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         if: ${{ inputs.enable-qemu }}
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         if: ${{ inputs.dotnet-version != '' }}
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
@@ -71,11 +71,11 @@ jobs:
         if: ${{ inputs.dotnet-publish-project != '' }}
         run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained false --output $(dirname ${{ inputs.dotnet-publish-project }})/bin/Release/net8.0/linux-arm64/publish
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         if: ${{ inputs.python-version != '' }}
         with:
           python-version: ${{ inputs.python-version }}
diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml
index e601c58..dbc8564 100644
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@@ -67,13 +67,13 @@ jobs:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true
diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml
index 84dbdb2..4da1267 100644
--- a/.github/workflows/cd-sam.yaml
+++ b/.github/workflows/cd-sam.yaml
@@ -42,7 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
 
diff --git a/.github/workflows/ci-dotnet.yaml b/.github/workflows/ci-dotnet.yaml
index eb6a52e..b9c1a00 100644
--- a/.github/workflows/ci-dotnet.yaml
+++ b/.github/workflows/ci-dotnet.yaml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
 
diff --git a/.github/workflows/ci-python-app.yaml b/.github/workflows/ci-python-app.yaml
index b829498..6966ec3 100644
--- a/.github/workflows/ci-python-app.yaml
+++ b/.github/workflows/ci-python-app.yaml
@@ -56,7 +56,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
 
@@ -105,7 +105,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip
@@ -129,7 +129,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
           cache: pip
diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index a434a97..b2a7e4d 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -54,7 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
 
@@ -83,7 +83,7 @@ jobs:
 
       - name: Setup Node.js
         if: ${{ inputs.run-cdk-synth }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
 
diff --git a/.github/workflows/ci-static.yaml b/.github/workflows/ci-static.yaml
index a30394e..dfd9ae5 100644
--- a/.github/workflows/ci-static.yaml
+++ b/.github/workflows/ci-static.yaml
@@ -72,7 +72,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         if: ${{ inputs.run-htmlhint || inputs.build-command != '' }}
         with:
           node-version: ${{ inputs.node-version }}
diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml
index 2808ee5..0558f77 100644
--- a/.github/workflows/ci-typescript-cdk.yaml
+++ b/.github/workflows/ci-typescript-cdk.yaml
@@ -69,7 +69,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         if: ${{ inputs.enable-qemu }}
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@v6
         if: ${{ inputs.dotnet-version != '' }}
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
@@ -78,7 +78,7 @@ jobs:
         if: ${{ inputs.dotnet-publish-project != '' }}
         run: dotnet publish ${{ inputs.dotnet-publish-project }} --configuration Release --runtime linux-arm64 --self-contained
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
diff --git a/.github/workflows/ci-typescript-frontend.yaml b/.github/workflows/ci-typescript-frontend.yaml
index 3973907..3103bfd 100644
--- a/.github/workflows/ci-typescript-frontend.yaml
+++ b/.github/workflows/ci-typescript-frontend.yaml
@@ -91,7 +91,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ inputs.node-version }}
           cache: npm
diff --git a/.github/workflows/compliance-audit.yaml b/.github/workflows/compliance-audit.yaml
index b5b0a69..0fb893d 100644
--- a/.github/workflows/compliance-audit.yaml
+++ b/.github/workflows/compliance-audit.yaml
@@ -76,7 +76,7 @@ jobs:
 
       - name: Run compliance audit
         id: audit
-        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index 17d5818..70c1e7d 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -417,6 +417,10 @@ Resources:
                   - s3:PutLifecycleConfiguration
                   - s3:GetBucketPublicAccessBlock
                   - s3:PutBucketPublicAccessBlock
+                  # Explicit BucketEncryption blocks (first: payments-dashboard
+                  # BoaRawBucket, 2026-07-22) need the encryption config pair.
+                  - s3:GetEncryptionConfiguration
+                  - s3:PutEncryptionConfiguration
                   - s3:GetBucketNotification
                   - s3:PutBucketNotification
                   - s3:GetBucketWebsite