diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt
index 943d59518..4295ae70e 100644
--- a/.github/actions-lock.txt
+++ b/.github/actions-lock.txt
@@ -1,23 +1,23 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
-93826e24ee7f83d32dc39574505abc5a appstore-build-publish.yml
-c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml
+61aec074ea531e1039929ea028af5efe appstore-build-publish.yml
+e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml
 2581a67c5bcdcd570427e6d51db767d7 fixup.yml
-89736ea5a0440c90b73f5c722a456073 lint-eslint.yml
+92d7708f80f4e09d3aeb7d1d93168988 lint-eslint.yml
 43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml
-79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml
-300be6a756abda800e40850918f2d964 lint-php.yml
-69ab1f99e6b290ca48c6ad916fd567cd lint-stylelint.yml
-7cf9381a66a8853f634cf52a7da4bb3b node-test.yml
-f7a6f6f621446f9da93e4e4e2d3defc0 openapi.yml
-6d8eebf482b2932971b7912139f16d9f phpunit-mariadb.yml
-3cacf28a710b387e83d3858af40b7ffe phpunit-mysql.yml
-f89c18551d6a29af9bca63a0fd30a039 phpunit-oci.yml
-12a43f55ac6aedc321b62e00f9d864f0 phpunit-pgsql.yml
-ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml
+230493ed3855e3f7d9209cc63e9dbe13 lint-php-cs.yml
+994cce702e8c1ec02e45e113e48512b6 lint-php.yml
+ef5d06d720012cc3ea8fa9396682a133 lint-stylelint.yml
+c020389618342a238fdc232439a486ef node-test.yml
+9d98bd8d893b0a24c0202bc1c4fd5ea4 openapi.yml
+9a40d9f4ed2a328a0ae7fedc5b380089 phpunit-mariadb.yml
+ccf70525553e797b8d7a1fb30d344323 phpunit-mysql.yml
+dc762923203b94da162ea3339b23ea65 phpunit-oci.yml
+2b074ba7d721c93009615d0f917ad972 phpunit-pgsql.yml
+eaef9ddd2f5552e34c3bc921a48c5e1f phpunit-sqlite.yml
 2639f2b96989a4fcbb441ca8f1fecb2f pr-feedback.yml
-6c355cb7b5d4da4d56a58e6d7f82881b psalm-matrix.yml
-c2fc57f15bc64e5066b79a398021ca1a rector-apply.yml
+d1e7dba2e25a3921ba09a8357bcd47c5 psalm-matrix.yml
+5435f641f9a7ba1e89e33d6ef024e497 rector-apply.yml
 2dbec18233063b42f4d8e03bbb43671c reuse.yml
-511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml
-d47b15109ec7ef7e52fda996796449ed playwright.yml
+0bb535f552ee8f94dae6eeb16f7f4a4e sync-workflow-templates.yml
+24e22c1cb2f2b5797d64ff650dc762dc playwright.yml
diff --git a/.github/workflows/appstore-build-publish.yml b/.github/workflows/appstore-build-publish.yml
index 8f1e541ee..43461b17f 100644
--- a/.github/workflows/appstore-build-publish.yml
+++ b/.github/workflows/appstore-build-publish.yml
@@ -59,7 +59,7 @@ jobs:
           expression: "//info//dependencies//nextcloud/@min-version"
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml
index eaa1e9f28..76340acb5 100644
--- a/.github/workflows/dependabot-approve-merge.yml
+++ b/.github/workflows/dependabot-approve-merge.yml
@@ -9,7 +9,7 @@
 name: Auto approve Dependabot PRs
 
 on:
-  pull_request:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     branches:
       - main
       - master
diff --git a/.github/workflows/lint-eslint.yml b/.github/workflows/lint-eslint.yml
index 8021ce587..c1353ce58 100644
--- a/.github/workflows/lint-eslint.yml
+++ b/.github/workflows/lint-eslint.yml
@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/.github/workflows/lint-stylelint.yml b/.github/workflows/lint-stylelint.yml
index 39fb96e34..fd5580530 100644
--- a/.github/workflows/lint-stylelint.yml
+++ b/.github/workflows/lint-stylelint.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml
index 4d9458a23..5e3b6341e 100644
--- a/.github/workflows/node-test.yml
+++ b/.github/workflows/node-test.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index e721ca57d..721f52f01 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/.github/workflows/phpunit-sqlite.yml.patch b/.github/workflows/phpunit-sqlite.yml.patch
index 9d50ecf97..9262014ae 100644
--- a/.github/workflows/phpunit-sqlite.yml.patch
+++ b/.github/workflows/phpunit-sqlite.yml.patch
@@ -1,8 +1,8 @@
 diff --git a/.github/workflows/phpunit-sqlite.yml b/.github/workflows/phpunit-sqlite.yml
-index 273400a4..9d11374f 100644
+index ccb41495..c969d871 100644
 --- a/.github/workflows/phpunit-sqlite.yml
 +++ b/.github/workflows/phpunit-sqlite.yml
-@@ -95,13 +95,29 @@ jobs:
+@@ -93,13 +93,29 @@ jobs:
            persist-credentials: false
            path: apps/${{ env.APP_NAME }}
  
@@ -23,7 +23,7 @@ index 273400a4..9d11374f 100644
 +          path: apps/analytics
 +
        - name: Set up php ${{ matrix.php-versions }}
-         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
          with:
            php-version: ${{ matrix.php-versions }}
            # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
@@ -38,7 +38,7 @@ index 273400a4..9d11374f 100644
          run: composer run test:unit
  
 +      - name: Upload Unit coverage
-+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
++        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
 +        with:
 +          working-directory: apps/${{ env.APP_NAME }}
 +          disable_search: true
@@ -54,7 +54,7 @@ index 273400a4..9d11374f 100644
          run: composer run test:integration
  
 +      - name: Upload Integration coverage
-+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
++        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
 +        with:
 +          working-directory: apps/${{ env.APP_NAME }}
 +          disable_search: true
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index aba194280..c1a4e5cbd 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -48,7 +48,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Read package.json
-      uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+      uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
       id: versions
     - name: Check composer.json
       id: check_composer
@@ -104,7 +104,7 @@ jobs:
         persist-credentials: false
 
     - name: Read package.json
-      uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
+      uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
       id: versions
 
     - name: Set up node
diff --git a/.github/workflows/playwright.yml.patch b/.github/workflows/playwright.yml.patch
index 03f94b6fd..8aad8b1f6 100644
--- a/.github/workflows/playwright.yml.patch
+++ b/.github/workflows/playwright.yml.patch
@@ -14,7 +14,7 @@ index 6156b86f..24f48f88 100644
  
  permissions:
    contents: read
-@@ -138,61 +135,6 @@ jobs:
+@@ -135,61 +135,6 @@ jobs:
          path: blob-report
          retention-days: 1
  
@@ -37,7 +37,7 @@ index 6156b86f..24f48f88 100644
 -      with:
 -        persist-credentials: false
 -
--    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+-    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
 -      if: steps.cache.outputs.cache-hit != 'true'
 -      with:
 -        node-version: ${{ needs.playwright-tests.outputs.node-version }}
@@ -51,7 +51,7 @@ index 6156b86f..24f48f88 100644
 -      run: npm ci
 -
 -    - name: Download blob reports from GitHub Actions Artifacts
--      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+-      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
 -      with:
 -        path: all-blob-reports
 -        pattern: blob-report-*
@@ -61,7 +61,7 @@ index 6156b86f..24f48f88 100644
 -      run: npx playwright merge-reports --config tests/playwright/merge.config.ts --reporter html,github ./all-blob-reports
 -
 -    - name: Upload HTML report
--      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+-      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
 -      with:
 -        name: html-report--attempt-${{ github.run_attempt }}
 -        path: playwright-report
diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml
index b43db987d..b21b45080 100644
--- a/.github/workflows/sync-workflow-templates.yml
+++ b/.github/workflows/sync-workflow-templates.yml
@@ -12,7 +12,7 @@ name: Update workflows
 on:
   workflow_dispatch:
   schedule:
-      - cron: "5 2 * * 0"
+      - cron: "45 22 * * 6"
 
 permissions:
   contents: read
@@ -54,7 +54,32 @@ jobs:
           path: target
           ref: ${{ matrix.branches }}
 
+      - name: Check for active merge freeze
+        id: freeze
+        env:
+          BRANCH_NAME: ${{ matrix.branches }}
+        run: |
+          if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then
+            echo 'No block-merge-freeze workflow, continuing'
+            exit 0
+          fi
+          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+            SERVER_REF='master'
+          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+            SERVER_REF="$BRANCH_NAME"
+          else
+            echo 'Not based on master/main/stable*, so skipping freeze check'
+            exit 0
+          fi
+          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+            echo "Merge freeze is active for $SERVER_REF, skipping"
+            echo 'active=true' >> $GITHUB_OUTPUT
+          fi
+          rm version.php
+
       - name: Copy all workflow templates
+        if: steps.freeze.outputs.active != 'true'
         run: |
           echo 'SUMMARY<<EOF' >> $GITHUB_ENV
           draft_only=0
@@ -119,6 +144,7 @@ jobs:
           echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
+        if: steps.freeze.outputs.active != 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}