diff --git a/.github/workflows/buildenv-diff.yml b/.github/workflows/buildenv-diff.yml
index 9e417b8..c163557 100644
--- a/.github/workflows/buildenv-diff.yml
+++ b/.github/workflows/buildenv-diff.yml
@@ -18,7 +18,7 @@ jobs:
       labels: edera-16
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: checkout repository
diff --git a/.github/workflows/buildenv.yml b/.github/workflows/buildenv.yml
index 52378e0..855ca86 100644
--- a/.github/workflows/buildenv.yml
+++ b/.github/workflows/buildenv.yml
@@ -38,13 +38,13 @@ jobs:
     runs-on: "${{ matrix.runner }}"
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - name: docker setup buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: docker login ghcr.io
         uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         with:
@@ -67,7 +67,7 @@ jobs:
           docker run --rm "${IMAGE}@$(cat digest-${{ matrix.arch }})" \
             cat /usr/share/buildenv/packages.tsv > "packages-${{ matrix.arch }}.tsv"
       - name: upload digest
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: "buildenv-digest-${{ matrix.arch }}"
           path: "digest-${{ matrix.arch }}"
@@ -75,7 +75,7 @@ jobs:
           compression-level: 0
           retention-days: 1
       - name: upload package manifest
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: "buildenv-packages-${{ matrix.arch }}"
           path: "packages-${{ matrix.arch }}.tsv"
@@ -89,13 +89,13 @@ jobs:
       labels: edera-16
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: docker setup buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: docker login ghcr.io
         uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         with:
@@ -105,7 +105,7 @@ jobs:
             username: "${{github.actor}}"
             password: "${{secrets.GITHUB_TOKEN}}"
       - name: download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: "buildenv-digest-*"
           merge-multiple: true
diff --git a/.github/workflows/digestabot.yml b/.github/workflows/digestabot.yml
index 005631e..514c66d 100644
--- a/.github/workflows/digestabot.yml
+++ b/.github/workflows/digestabot.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 9aa3d02..ca03e1b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -31,7 +31,7 @@ jobs:
           curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ -C /tmp
           install -m755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck"
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           python-version: "3.14"
       - name: Show versions
diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml
index 577c573..d21cba9 100644
--- a/.github/workflows/matrix.yml
+++ b/.github/workflows/matrix.yml
@@ -24,11 +24,11 @@ jobs:
       labels: edera-16
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
       with:
         egress-policy: audit
     - name: Install the latest version of uv
-      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: "3.14"
     - name: Setup Crane
@@ -42,7 +42,7 @@ jobs:
     - name: generate matrix
       run: './hack/build/generate-matrix.sh "${{ inputs.spec }}"'
     - name: upload matrix
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: matrix
         path: "matrix.json"
@@ -83,17 +83,17 @@ jobs:
       KERNEL_ARCH: "${{ matrix.builds.arch }}"
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
       - name: report disk space (before)
-        uses: edera-dev/actions/report-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17
+        uses: edera-dev/actions/report-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19
       - name: reclaim runner disk space
         # Kernel builds never touch Rust or the hosted toolcache, so both
         # opt-in removals are on. Must stay before cosign-installer, which
         # installs into the toolcache this deletes.
-        uses: edera-dev/actions/reclaim-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17
+        uses: edera-dev/actions/reclaim-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19
         with:
           remove-toolcache: 'true'
           remove-rust: 'true'
@@ -132,7 +132,7 @@ jobs:
       # - name: docker setup linux-kernel-oci
       #   run: sudo uv run ./hack/build/docker-setup.py
       - name: docker setup buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: docker login ghcr.io
         uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         with:
@@ -148,19 +148,19 @@ jobs:
         # list in hack/build/generate-docker-script.py (docker_compile); a
         # name missing there silently never reaches the build container.
         id: sccache
-        uses: edera-dev/actions/configure-azure-sccache@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17
+        uses: edera-dev/actions/configure-azure-sccache@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19
         with:
           connection-string-rw: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }}
           connection-string-ro: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING_RO }}
           key-prefix: kernel
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           python-version: "3.14"
       - name: generate docker script
         run: "./hack/build/generate-docker-script.sh"
       - name: upload docker script
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: "build-${{ matrix.builds.branch }}-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}-${{ matrix.builds.arch }}.sh"
           path: "docker.sh"
@@ -172,11 +172,11 @@ jobs:
       - name: report disk space (after)
         # always() so ENOSPC failures still show where the disk went.
         if: always()
-        uses: edera-dev/actions/report-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17
+        uses: edera-dev/actions/report-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19
       - name: upload digests
         # Only produced when publishing — push-by-digest path writes digests.json.
         if: ${{ inputs.publish }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: "digests-${{ matrix.builds.branch }}-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}-${{ matrix.builds.arch }}"
           path: "digests.json"
@@ -208,13 +208,13 @@ jobs:
       DIGESTS_DIR: digests
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           python-version: '3.14'
       - name: install python deps
@@ -222,7 +222,7 @@ jobs:
       - name: install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: docker setup buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: docker login ghcr.io
         uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
         with:
@@ -232,7 +232,7 @@ jobs:
             username: "${{github.actor}}"
             password: "${{secrets.GITHUB_TOKEN}}"
       - name: download digest artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           # Each per-arch build uploads its digests under a uniquely-named
           # artifact; pattern + default merge-multiple=false drops each artifact
@@ -242,7 +242,7 @@ jobs:
       - name: generate merge script
         run: uv run ./hack/build/generate-merge-script.py
       - name: upload merge script
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: "merge-${{ matrix.merges.branch }}-${{ matrix.merges.version }}-${{ matrix.merges.flavor }}.sh"
           path: "merge.sh"
diff --git a/.github/workflows/pr-review-selftest.yml b/.github/workflows/pr-review-selftest.yml
index b7c7425..f46d925 100644
--- a/.github/workflows/pr-review-selftest.yml
+++ b/.github/workflows/pr-review-selftest.yml
@@ -39,12 +39,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pr-review-suggestions.yml b/.github/workflows/pr-review-suggestions.yml
index 83849d8..c0b2056 100644
--- a/.github/workflows/pr-review-suggestions.yml
+++ b/.github/workflows/pr-review-suggestions.yml
@@ -40,12 +40,12 @@ jobs:
       id-token: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -82,7 +82,7 @@ jobs:
       - name: Suggest
         id: suggest
         continue-on-error: true
-        uses: anthropics/claude-code-action@e8c2d7c16c018cf1e694711c1c07a5f5db2b5eb1 # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1
         env:
           GH_TOKEN: ${{ github.token }}
         with:
diff --git a/.github/workflows/pr-test-coverage.yml b/.github/workflows/pr-test-coverage.yml
index fbe6622..54ae69e 100644
--- a/.github/workflows/pr-test-coverage.yml
+++ b/.github/workflows/pr-test-coverage.yml
@@ -39,12 +39,12 @@ jobs:
       id-token: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -87,7 +87,7 @@ jobs:
       - name: Review
         id: review
         continue-on-error: true
-        uses: anthropics/claude-code-action@e8c2d7c16c018cf1e694711c1c07a5f5db2b5eb1 # v1
+        uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1
         env:
           GH_TOKEN: ${{ github.token }}
         with:
diff --git a/.github/workflows/refresh-nvidia.yml b/.github/workflows/refresh-nvidia.yml
index 83d1cd4..f37bc5a 100644
--- a/.github/workflows/refresh-nvidia.yml
+++ b/.github/workflows/refresh-nvidia.yml
@@ -15,7 +15,7 @@ jobs:
       labels: edera-16
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: checkout repository