diff --git a/.github/workflows/agents-md-integrity.yml b/.github/workflows/agents-md-integrity.yml
index e020dea9..7faa31fa 100644
--- a/.github/workflows/agents-md-integrity.yml
+++ b/.github/workflows/agents-md-integrity.yml
@@ -16,6 +16,6 @@ jobs:
   agents-md:
     permissions:
       contents: read
-    uses: Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml@c6b3effa6d2e9fff97500d9688b54106f556c433 # github-workflows main (c6b3eff)
+    uses: Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml@e203fbcc66ae92a4d492ca9cf6dc6a3d844a9b4b # github-workflows main (c6b3eff)
     with:
       workflows_ref: c6b3effa6d2e9fff97500d9688b54106f556c433
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 0f5da884..adb44865 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/ci-cursor-review.yml b/.github/workflows/ci-cursor-review.yml
index 222ddd5a..dd23ddf0 100644
--- a/.github/workflows/ci-cursor-review.yml
+++ b/.github/workflows/ci-cursor-review.yml
@@ -29,7 +29,7 @@ jobs:
     # SHA-pinned. Bump this SHA to pick up upstream changes; keep
     # `workflows_ref` matching so prompts/scripts load from the same commit as
     # the workflow definition.
-    uses: Comfy-Org/github-workflows/.github/workflows/cursor-review.yml@ffcc3f5b4dfc568e846e769c4f4df4f749c7887b # github-workflows main (ffcc3f5)
+    uses: Comfy-Org/github-workflows/.github/workflows/cursor-review.yml@e203fbcc66ae92a4d492ca9cf6dc6a3d844a9b4b # github-workflows main (ffcc3f5)
     with:
       # Overriding diff_excludes replaces the reusable default wholesale, so
       # this restates the generated/vendored defaults and adds this repo's
diff --git a/.github/workflows/groom.yml b/.github/workflows/groom.yml
index a0e0ff61..1ef5df18 100644
--- a/.github/workflows/groom.yml
+++ b/.github/workflows/groom.yml
@@ -87,7 +87,7 @@ jobs:
       # Omitting it rejects the run outright ("requesting 'actions: read', but is
       # only allowed 'actions: none'").
       actions: read
-    uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@c2315350ee0d60d0c5f16c1bdb0da7ecffc6d465 # main @ c231535
+    uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@e203fbcc66ae92a4d492ca9cf6dc6a3d844a9b4b # main @ c231535
     with:
       # File as cloud-code-bot (App token) rather than github-actions[bot]. Absent
       # APP_ID degrades to github-actions[bot] instead of failing.
diff --git a/.github/workflows/public-repo-hygiene.yml b/.github/workflows/public-repo-hygiene.yml
index e809d9df..a385ee08 100644
--- a/.github/workflows/public-repo-hygiene.yml
+++ b/.github/workflows/public-repo-hygiene.yml
@@ -22,7 +22,7 @@ jobs:
   hygiene:
     permissions:
       contents: read
-    uses: Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml@3b2c8ca1f52056b54453a659fdb4473cfc88aa0e # github-workflows main (3b2c8ca)
+    uses: Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml@e203fbcc66ae92a4d492ca9cf6dc6a3d844a9b4b # github-workflows main (3b2c8ca)
     with:
       # REQUIRED, and must equal the `uses:` SHA above — the reusable asserts
       # they match, which is what pins the checker to the reviewed commit.
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 6ad41444..dceede70 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           python-version: '3.10'  # Follow the min version in pyproject.toml
diff --git a/.github/workflows/refresh-cql-catalogs.yml b/.github/workflows/refresh-cql-catalogs.yml
index 0fd4dc8b..c3eea8c7 100644
--- a/.github/workflows/refresh-cql-catalogs.yml
+++ b/.github/workflows/refresh-cql-catalogs.yml
@@ -74,7 +74,7 @@ jobs:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Persist the app token (not the default GITHUB_TOKEN) as the credential
           # for `origin` so the later force-push is authored by the bot and fires
@@ -131,7 +131,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.10'  # Follow the min version in pyproject.toml