diff --git a/.github/workflows/ci-dependencies.yml b/.github/workflows/ci-dependencies.yml
index fd4900a..645a750 100644
--- a/.github/workflows/ci-dependencies.yml
+++ b/.github/workflows/ci-dependencies.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
     # actions/setup-python v6.2.0
@@ -25,7 +25,7 @@ jobs:
       with:
         python-version: '3.14'
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
     - name: Install apt dependencies (Weblate venv)
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
index 2a85f54..54fe578 100644
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
     # actions/cache v5.0.5
@@ -32,7 +32,7 @@ jobs:
       with:
         python-version: '3.14'
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
     - name: Install apt dependencies (Weblate venv)
diff --git a/.github/workflows/ci-package.yml b/.github/workflows/ci-package.yml
index e1ac540..1029c3b 100644
--- a/.github/workflows/ci-package.yml
+++ b/.github/workflows/ci-package.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
     # actions/setup-python v6.2.0
@@ -24,7 +24,7 @@ jobs:
       with:
         python-version: '3.14'
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         enable-cache: false
         version: 0.11.12
diff --git a/.github/workflows/ci-plugin-auth.yml b/.github/workflows/ci-plugin-auth.yml
index abf7468..2db569a 100644
--- a/.github/workflows/ci-plugin-auth.yml
+++ b/.github/workflows/ci-plugin-auth.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
 
@@ -28,7 +28,7 @@ jobs:
         python-version: '3.12'
 
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
 
@@ -40,7 +40,7 @@ jobs:
     - name: Upload logs on failure
       if: failure()
       # actions/upload-artifact v4.6.2
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
       with:
         name: ci-plugin-auth-logs
         path: /tmp/compose-logs.txt
diff --git a/.github/workflows/ci-plugin-functional.yml b/.github/workflows/ci-plugin-functional.yml
index c638592..e3b42d4 100644
--- a/.github/workflows/ci-plugin-functional.yml
+++ b/.github/workflows/ci-plugin-functional.yml
@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 25
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
 
@@ -38,7 +38,7 @@ jobs:
         python-version: '3.12'
 
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
 
@@ -51,7 +51,7 @@ jobs:
     - name: Upload logs on failure
       if: failure()
       # actions/upload-artifact v4.6.2
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
       with:
         name: ci-plugin-functional-logs
         path: /tmp/compose-logs.txt
diff --git a/.github/workflows/ci-plugin-smoke.yml b/.github/workflows/ci-plugin-smoke.yml
index ac13f6a..3a3749a 100644
--- a/.github/workflows/ci-plugin-smoke.yml
+++ b/.github/workflows/ci-plugin-smoke.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 15
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
 
@@ -28,7 +28,7 @@ jobs:
         python-version: '3.12'
 
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
 
@@ -40,7 +40,7 @@ jobs:
     - name: Upload logs on failure
       if: failure()
       # actions/upload-artifact v4.6.2
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
       with:
         name: ci-plugin-smoke-logs
         path: /tmp/compose-logs.txt
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 789c219..c5b7c87 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
     # actions/setup-python v6.2.0
@@ -25,7 +25,7 @@ jobs:
       with:
         python-version: '3.14'
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
     - name: Install apt dependencies (Weblate venv)
@@ -44,7 +44,7 @@ jobs:
       run: uv run --group dev coverage report
     # actions/upload-artifact v4.6.2
     - name: Upload coverage artifacts
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
       with:
         name: coverage-${{ github.event.pull_request.number || github.run_id }}
         path: |
diff --git a/.github/workflows/ci-weblate-pin.yml b/.github/workflows/ci-weblate-pin.yml
index 312f226..389b077 100644
--- a/.github/workflows/ci-weblate-pin.yml
+++ b/.github/workflows/ci-weblate-pin.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         persist-credentials: false
     - name: Check PyPI and Docker Weblate pins
diff --git a/.github/workflows/promote-main.yml b/.github/workflows/promote-main.yml
index 5225abf..718af26 100644
--- a/.github/workflows/promote-main.yml
+++ b/.github/workflows/promote-main.yml
@@ -27,7 +27,7 @@ jobs:
       contents: read
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         ref: main
         fetch-depth: 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ecfe3a..6c1c5c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 10
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
       with:
         ref: main
         fetch-depth: 0
diff --git a/.github/workflows/weblate-pin-bump.yml b/.github/workflows/weblate-pin-bump.yml
index fc7603e..7c2c0ff 100644
--- a/.github/workflows/weblate-pin-bump.yml
+++ b/.github/workflows/weblate-pin-bump.yml
@@ -24,9 +24,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # actions/checkout v6.0.2
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
     # astral-sh/setup-uv v8.1.0
-    - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
       with:
         version: 0.11.12
     - name: Resolve and apply Weblate bump