diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6cbca4dd8..73b0413d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
     - name: Set up Python
       # The runner image is Amazon Linux; actions/setup-python only ships Ubuntu
       # builds, so uv provides the interpreter and activates a venv.
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: "3.12"
         activate-environment: true
@@ -64,7 +64,7 @@ jobs:
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
     - name: Set up Python ${{ matrix.python-version }}
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ matrix.python-version }}
         activate-environment: true
diff --git a/.github/workflows/cloud-tests.yml b/.github/workflows/cloud-tests.yml
index da80a43e2..80b5051ed 100644
--- a/.github/workflows/cloud-tests.yml
+++ b/.github/workflows/cloud-tests.yml
@@ -65,7 +65,7 @@ jobs:
     - name: Setup Python
       # The runner image is Amazon Linux; actions/setup-python only ships Ubuntu
       # builds, so uv provides the interpreter and activates a venv.
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ matrix.python-version }}
         activate-environment: true
diff --git a/.github/workflows/conformance-tests.yml b/.github/workflows/conformance-tests.yml
index 2d660987e..b3d70c205 100644
--- a/.github/workflows/conformance-tests.yml
+++ b/.github/workflows/conformance-tests.yml
@@ -89,7 +89,7 @@ jobs:
     - name: Setup Python
       # The runner image is Amazon Linux; actions/setup-python only ships Ubuntu
       # builds, so uv provides the Python 3.14 interpreter and activates a venv.
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: "3.14"
         activate-environment: true
@@ -158,7 +158,7 @@ jobs:
 
     - name: Upload conformance report
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: conformance-report-${{ matrix.suite }}
         path: |
diff --git a/.github/workflows/js-examples.yml b/.github/workflows/js-examples.yml
index 76cfcbabf..1b911c7bb 100644
--- a/.github/workflows/js-examples.yml
+++ b/.github/workflows/js-examples.yml
@@ -59,7 +59,7 @@ jobs:
       with:
         python-version: "3.14"
 
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         # The JS SDK's CI runs on Node.js 22.
         node-version: "22.x"
@@ -74,7 +74,7 @@ jobs:
 
     - name: Upload logs and report
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: js-examples-logs
         path: ${{ runner.temp }}/js-examples
diff --git a/.github/workflows/lambda-layer-publish.yml b/.github/workflows/lambda-layer-publish.yml
index ae418a9ca..9c833edf4 100644
--- a/.github/workflows/lambda-layer-publish.yml
+++ b/.github/workflows/lambda-layer-publish.yml
@@ -139,7 +139,7 @@ jobs:
           cp packages/aws-durable-execution-sdk-python-otel/dist/*.whl release-dists/
 
       - name: Upload wheels
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: lambda-layer-distributions
           path: release-dists/
@@ -161,7 +161,7 @@ jobs:
           python-version: "3.11"
 
       - name: Download wheels
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: lambda-layer-distributions
           path: release-dists/
@@ -180,7 +180,7 @@ jobs:
           echo "layer_zip=${LAYER_ZIP}" >> "$GITHUB_OUTPUT"
 
       - name: Upload layer artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: otel-plugin-layer
           path: ${{ steps.build-layer.outputs.layer_zip }}
@@ -200,7 +200,7 @@ jobs:
 
     steps:
       - name: Download layer artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: otel-plugin-layer
           path: dist/
diff --git a/.github/workflows/opentelemetry-conformance-tests.yml b/.github/workflows/opentelemetry-conformance-tests.yml
index 4b4f2215a..6ce0099f5 100644
--- a/.github/workflows/opentelemetry-conformance-tests.yml
+++ b/.github/workflows/opentelemetry-conformance-tests.yml
@@ -66,7 +66,7 @@ jobs:
       actions: write
       contents: read
       id-token: write
-    uses: aws/aws-durable-execution-conformance-tests/.github/workflows/opentelemetry-orchestrator.yml@f18bd0b5f28c5c90e288d0fb8bca08a849b51863
+    uses: aws/aws-durable-execution-conformance-tests/.github/workflows/opentelemetry-orchestrator.yml@e48ac54502d3c14e2e3fa216c5e200dbb4c14ac2
     with:
       language: python
       runs_on: codebuild-github-actions-runner-${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index e8be69555..ddc102c8a 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -50,7 +50,7 @@ jobs:
         run: python .github/scripts/check_dist_legal_files.py ${{ matrix.package.path }}
 
       - name: Upload distributions
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: release-dists-${{ matrix.package.name }}
           path: ${{ matrix.package.path }}/dist/
@@ -76,7 +76,7 @@ jobs:
 
     steps:
       - name: Retrieve release distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           name: release-dists-${{ matrix.package.name }}
           path: dist/
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 214750982..e39956bfd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -66,7 +66,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -75,6 +75,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stale-issue-closer.yml b/.github/workflows/stale-issue-closer.yml
index e8e59137b..604383195 100644
--- a/.github/workflows/stale-issue-closer.yml
+++ b/.github/workflows/stale-issue-closer.yml
@@ -14,4 +14,4 @@ jobs:
     permissions:
       contents: read
       issues: write
-    uses: aws/aws-durable-execution-ci/.github/workflows/stale-issue-closer.yml@48b3b4349f7d00a6212b9d959427bd7df81ea99d
+    uses: aws/aws-durable-execution-ci/.github/workflows/stale-issue-closer.yml@288e4317948ca778ebf01acca9342d8b898a1dc2
diff --git a/.github/workflows/test-parser.yml b/.github/workflows/test-parser.yml
index 53a2c2884..26d2eb80f 100644
--- a/.github/workflows/test-parser.yml
+++ b/.github/workflows/test-parser.yml
@@ -46,7 +46,7 @@ jobs:
     - name: Set up Python
       # The runner image is Amazon Linux; actions/setup-python only ships Ubuntu
       # builds, so uv provides the interpreter and activates a venv.
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: "3.13"
         activate-environment: true