diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6db28e3..3769e80 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   dotnet:
     name: .NET Build & Test
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       working-directory: api
       solution: ProposalSystem.sln
@@ -30,7 +30,7 @@ jobs:
     # Phase 5: full frontend pipeline — format:check, build (tsc -b included),
     # vitest, Playwright chromium smoke. Replaces the old typecheck-only job
     # plus the standalone Web Tests job. No lint script yet (run-lint: false).
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       working-directory: web
       cache-dependency-path: web/package-lock.json
@@ -40,7 +40,7 @@ jobs:
 
   python:
     name: Python Lint
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       source-dirs: "lambdas/"
       run-sam-validate: false
@@ -54,7 +54,7 @@ jobs:
       run:
         working-directory: lambdas
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
@@ -68,7 +68,7 @@ jobs:
 
   mobile:
     name: Mobile Typecheck
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
@@ -78,7 +78,7 @@ jobs:
 
   infra:
     name: CDK Synth
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       working-directory: infra
       cache-dependency-path: infra/package-lock.json
diff --git a/.github/workflows/deploy-mobile.yaml b/.github/workflows/deploy-mobile.yaml
index 786ee76..60bc058 100644
--- a/.github/workflows/deploy-mobile.yaml
+++ b/.github/workflows/deploy-mobile.yaml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   deploy-ios:
     name: Build & Upload to TestFlight
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 4f49c2b..0f94d40 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy to AWS
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
     with:
       cdk-dir: infra
       dotnet-version: "8.0.x"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 90b2c46..373e8ee 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -10,4 +10,4 @@ permissions:
 
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
diff --git a/api/global.json b/api/global.json
index 391ba3c..005dd8f 100644
--- a/api/global.json
+++ b/api/global.json
@@ -1,6 +1,6 @@
 {
   "sdk": {
-    "version": "8.0.100",
+    "version": "8.0.424",
     "rollForward": "latestFeature"
   }
 }
diff --git a/api/src/ProposalSystem.Api/ProposalSystem.Api.csproj b/api/src/ProposalSystem.Api/ProposalSystem.Api.csproj
index 1bf58ed..fd4d8f7 100644
--- a/api/src/ProposalSystem.Api/ProposalSystem.Api.csproj
+++ b/api/src/ProposalSystem.Api/ProposalSystem.Api.csproj
@@ -24,7 +24,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Amazon.Lambda.AspNetCoreServer.Hosting" Version="2.2.0" />
+    <PackageReference Include="Amazon.Lambda.AspNetCoreServer.Hosting" Version="2.2.1" />
     <PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="3.7.400.2" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.30" />
     <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.1" />
diff --git a/docker-compose.yml b/docker-compose.yml
index d337060..5e1dcb8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   postgres:
-    image: postgres:15-alpine
+    image: postgres:15-alpine@sha256:fe0737ba566a2c5b2a28f34433c0a423261900ec17b9bf7ad115e1aae7e57f1b
     ports:
       - "5432:5432"
     environment: