diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index edc619a4e..40738518c 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -20,7 +20,7 @@ jobs:
       android: ${{ steps.filter.outputs.android }}
       release: ${{ steps.release.outputs.builds }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Nothing here pushes or fetches, so the job token is not left in
           # .git/config for the steps after this one.
@@ -67,12 +67,12 @@ jobs:
 
     steps:
       # Nothing here pushes, so the job token is not left in .git/config.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: "temurin"
           java-version: "25"
@@ -84,10 +84,10 @@ jobs:
       # built against an SDK nobody chose, and nothing in the build log would
       # say so. See AGENTS.md → Toolchain.
       - name: Install toolchain (mise)
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
 
       - name: Cache Android NDK
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             /usr/local/lib/android/sdk/ndk/27.0.12077973
@@ -95,7 +95,7 @@ jobs:
           key: ${{ runner.os }}-ndk-27-28
 
       - name: Cache Android sdk
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         env:
           cache-name: cache-Android-sdk
         with:
@@ -129,7 +129,7 @@ jobs:
         run: bash tool/dev/build.sh android
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: DPIP-Android-Release
           path: build/app/outputs/flutter-apk/*.apk
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fcb4614c9..228ddf392 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       # Full history: the commit gate walks the range this push or PR adds, and
       # a shallow clone has no base to compare against.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Nothing here pushes, and every step after this one runs code the
@@ -149,7 +149,7 @@ jobs:
       # developers run locally — one source of truth. v4 = Node 24 runtime
       # (Node 20 actions are forced onto 24 and emit deprecation warnings).
       - name: Install toolchain (mise)
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
 
       - name: Install dependencies
         run: bash tool/dev/deps.sh
@@ -210,7 +210,7 @@ jobs:
       # tokenless opt-out for public repositories, in the Codecov org settings.
       - name: Upload coverage to Codecov
         if: ${{ !cancelled() && hashFiles('coverage/lcov.info') != '' }}
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           use_oidc: true
           files: coverage/lcov.info
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 03904da8e..b0c83b963 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -32,7 +32,7 @@ jobs:
       ios: ${{ steps.filter.outputs.ios }}
       release: ${{ steps.release.outputs.builds }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Nothing here pushes or fetches, so the job token is not left in
           # .git/config for the steps after this one.
@@ -79,7 +79,7 @@ jobs:
 
     steps:
       # Nothing here pushes, so the job token is not left in .git/config.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -89,12 +89,12 @@ jobs:
       # built against an SDK nobody chose, and nothing in the build log would
       # say so. See AGENTS.md → Toolchain.
       - name: Install toolchain (mise)
-        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
 
       # The iOS build uses Swift Package Manager, not CocoaPods (there is no
       # Podfile). Cache SPM's clone/artifact store keyed on the resolved pins.
       - name: Cache Swift Packages
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           # build/ios/SourcePackages, not DerivedData. Flutter always passes
           # -clonedSourcePackagesDirPath pointing there (ios/xcodeproj.dart), so
@@ -136,7 +136,7 @@ jobs:
           zip -qr DPIP.ipa Payload
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: DPIP-iOS
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8e45ba55a..f36f545bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,7 +47,7 @@ jobs:
     steps:
       # Full history: the label counts this week's commits and the train reads
       # the newest tag. A shallow clone has neither.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Nothing in this job pushes; `gh` reads its token from GH_TOKEN.
@@ -172,7 +172,7 @@ jobs:
       contents: read
     steps:
       # Full history: tool/release/build_info.sh counts commits and reads tags.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Nothing in this job pushes, and it is the job holding the signing
@@ -200,12 +200,12 @@ jobs:
       # developer use. A published build is the one that most needs to be
       # reproducible, so it must not be the one tracking whatever "stable"
       # happens to mean on the day it runs.
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
         with:
           cache: true # zizmor: ignore[cache-poisoning] — accepted, see above
 
       - if: matrix.platform == 'android'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: "temurin"
           java-version: "25"
@@ -223,7 +223,7 @@ jobs:
       # precise key costs one full download on a dependency change and is
       # correct every time.
       - name: Cache pub packages
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.pub-cache
           key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.lock') }}
@@ -245,7 +245,7 @@ jobs:
       # main saved here and stored a fresh ~880 MB copy of its own.
       - name: Cache Swift packages
         if: matrix.platform == 'ios'
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/Library/Caches/org.swift.swiftpm
@@ -468,7 +468,7 @@ jobs:
         if: always() && matrix.platform == 'ios'
         run: rm -rf "$RUNNER_TEMP/private_keys"
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dpip-${{ matrix.platform }}
           path: DPIP-*.*
@@ -481,14 +481,14 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # Kept, and the one place it is: `Publish` pushes the snapshot tag
           # with `git push`. This job uploads no artifact for it to leak into.
           persist-credentials: true
 
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: artifacts
           merge-multiple: true
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index ca743ecc1..3778e9290 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -137,7 +137,7 @@ jobs:
       - name: Get PR context
         id: pr-context
         if: github.event_name == 'issue_comment'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // For issue_comment events, resolve PR base/head so the action