diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0aeb5838b..73d22c62b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -67,7 +67,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -95,6 +95,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         category: "/language:${{matrix.language}}"
\ No newline at end of file
diff --git a/.github/workflows/teams-api-drift-prs.yml b/.github/workflows/teams-api-drift-prs.yml
index 604ac07a2..e181ed800 100644
--- a/.github/workflows/teams-api-drift-prs.yml
+++ b/.github/workflows/teams-api-drift-prs.yml
@@ -207,7 +207,7 @@ jobs:
         continue-on-error: true
       - name: Set up Node for Copilot CLI
         if: ${{ steps.prepare-agent-context.outcome == 'success' }}
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
       - id: install-copilot-cli
@@ -247,7 +247,7 @@ jobs:
       # Upload all evidence before the final policy turns collected failures into a failed workflow.
       - name: Upload compatibility artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: teams-api-drift-pr-${{ github.run_id }}
           path: artifacts/teams-api-drift
diff --git a/.github/workflows/teams-api-drift-scheduled.yml b/.github/workflows/teams-api-drift-scheduled.yml
index 10dea3a41..d16b7011f 100644
--- a/.github/workflows/teams-api-drift-scheduled.yml
+++ b/.github/workflows/teams-api-drift-scheduled.yml
@@ -183,7 +183,7 @@ jobs:
       # Upload evidence before the policy gate or issue update can fail the run.
       - name: Upload scheduled drift artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: teams-api-drift-scheduled-${{ github.run_id }}
           path: artifacts/teams-api-drift
@@ -191,7 +191,7 @@ jobs:
           if-no-files-found: warn
       - name: Upload bounded publication inputs
         if: ${{ always() && steps.comparison-result.outputs.value == 'true' && hashFiles('artifacts/teams-api-drift/findings.json') != '' }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: teams-api-drift-scheduled-publication-${{ github.run_id }}
           path: |
@@ -249,14 +249,14 @@ jobs:
         run: python -m pip install --disable-pip-version-check -r scripts/teams-api-drift/requirements.txt
       - id: download-analysis
         name: Download bounded publication inputs
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: teams-api-drift-scheduled-publication-${{ github.run_id }}
           path: artifacts/teams-api-drift
         continue-on-error: true
       - name: Set up Node for Copilot CLI
         if: ${{ hashFiles('artifacts/teams-api-drift/agent-context.json') != '' }}
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
       - id: install-copilot-cli
@@ -324,7 +324,7 @@ jobs:
             }
       - name: Upload advisory artifacts
         if: ${{ always() && hashFiles('artifacts/teams-api-drift/agent-report.md') != '' }}
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: teams-api-drift-scheduled-advisory-${{ github.run_id }}
           path: |