diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6a7c61f..c451935 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,8 +23,8 @@ jobs:
       - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: SonarSource/ci-github-actions/config-pip@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: SonarSource/ci-github-actions/config-pip@d41706a4180f70b6c0d0479795309a6c99726022 # 2.0.0
       - uses: SonarSource/ci-github-actions/build-poetry@master # dogfood
         with:
           sonar-platform: sqc-eu
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 45997d4..9f13ea2 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -13,8 +13,8 @@ jobs:
       - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: SonarSource/ci-github-actions/config-pip@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: SonarSource/ci-github-actions/config-pip@d41706a4180f70b6c0d0479795309a6c99726022 # 2.0.0
       - name: Export pip index for isolated hook venvs
         run: |
           index_url="$(python3 -c 'import configparser, pathlib; c = configparser.ConfigParser(); c.read(pathlib.Path.home() / ".pip" / "pip.conf"); print(c["global"]["index-url"])')"
@@ -29,9 +29,9 @@ jobs:
             echo "PIP_TRUSTED_HOST=repox.jfrog.io"
           } >> "$GITHUB_ENV"
       - uses: SonarSource/ci-github-actions/config-npm@master # dogfood
-      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          version: 2025.12.13
+          version: 2026.8.13
       - uses: SonarSource/gh-action_pre-commit@0ecedc4e4070444a95f6b6714ddc3ebcdde697c4 # 1.1.0
         with:
           extra-args: >
diff --git a/.github/workflows/slack_notify.yml b/.github/workflows/slack_notify.yml
index f18ff5d..0a659b6 100644
--- a/.github/workflows/slack_notify.yml
+++ b/.github/workflows/slack_notify.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
-      - uses: SonarSource/ci-github-actions/config-pip@v1
+      - uses: SonarSource/ci-github-actions/config-pip@d41706a4180f70b6c0d0479795309a6c99726022 # 2.0.0
       - name: Send Slack Notification
         env:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/unified-dogfooding.yml b/.github/workflows/unified-dogfooding.yml
index 4832692..091e694 100644
--- a/.github/workflows/unified-dogfooding.yml
+++ b/.github/workflows/unified-dogfooding.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: SonarSource/ci-github-actions/build-poetry@master # dogfood
         with:
           run-shadow-scans: true