diff --git a/.github/actions/ai-pr-review/action.yml b/.github/actions/ai-pr-review/action.yml
index abbdc33c..6d67a8c1 100644
--- a/.github/actions/ai-pr-review/action.yml
+++ b/.github/actions/ai-pr-review/action.yml
@@ -95,7 +95,7 @@ runs:
 
     - name: Claude PR review
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic'
-      uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1.0.233
+      uses: anthropics/claude-code-action@f3b070c88125d33dbae5653df5f143101d4ea9dc # v1.0.276
       with:
         anthropic_api_key: ${{ inputs.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret
         github_token: ${{ inputs.github-token }}
@@ -144,7 +144,7 @@ runs:
     - name: Codex PR review
       id: codex
       if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai'
-      uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.12
+      uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1.13
       with:
         openai-api-key: ${{ inputs.openai-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret
         model: ${{ steps.cfg.outputs.model }}
diff --git a/.github/actions/checkov/action.yml b/.github/actions/checkov/action.yml
index 5ce06e92..0c244d28 100644
--- a/.github/actions/checkov/action.yml
+++ b/.github/actions/checkov/action.yml
@@ -166,7 +166,7 @@ branding:
 runs:
   using: 'docker'
   # renovate manages this tag via the built-in github-actions manager (runs.image).
-  image: 'docker://ghcr.io/bridgecrewio/checkov:3.3.0'
+  image: 'docker://ghcr.io/bridgecrewio/checkov:3.4.5'
   args:
     - ${{ inputs.file }}
     - ${{ inputs.directory }}
diff --git a/.github/actions/comment-triggered-check/action.yml b/.github/actions/comment-triggered-check/action.yml
index accae5d3..7072ee0e 100644
--- a/.github/actions/comment-triggered-check/action.yml
+++ b/.github/actions/comment-triggered-check/action.yml
@@ -225,7 +225,7 @@ runs:
       id: app-token
       if: inputs.app-client-id != '' && inputs.app-private-key != ''
       continue-on-error: true
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       with:
         client-id: ${{ inputs.app-client-id }}
         private-key: ${{ inputs.app-private-key }}
diff --git a/.github/actions/cve-scan/action.yml b/.github/actions/cve-scan/action.yml
index 3a3fe2ed..feafa7b8 100644
--- a/.github/actions/cve-scan/action.yml
+++ b/.github/actions/cve-scan/action.yml
@@ -122,7 +122,7 @@ runs:
 
     - name: Log in to the image registry
       if: inputs.registry-password != '' && !contains(fromJSON('["false","no","0","off"]'), inputs.enabled)
-      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
       # A registry that can't be reached is inconclusive, not a finding, so this
       # must not fail the caller's job — run.sh classifies the pull failure that
       # follows. See README, "Three failure modes".
diff --git a/.github/actions/go-licenses/action.yml b/.github/actions/go-licenses/action.yml
index 640c7e89..fd6937c9 100644
--- a/.github/actions/go-licenses/action.yml
+++ b/.github/actions/go-licenses/action.yml
@@ -133,7 +133,7 @@ runs:
 
     - name: Create pull request
       if: inputs.mode == 'report'
-      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+      uses: peter-evans/create-pull-request@3ffccacd46053766916f087ce41d627c0b8cf2d1 # v8.1.3
       with:
         token: ${{ inputs.gh-access-token }}
         committer: Loft Bot <loft-bot@users.noreply.github.com>
diff --git a/.github/actions/prerelease-setup/action.yml b/.github/actions/prerelease-setup/action.yml
index b03673f7..615dc2ba 100644
--- a/.github/actions/prerelease-setup/action.yml
+++ b/.github/actions/prerelease-setup/action.yml
@@ -62,10 +62,10 @@ runs:
         cache: true
 
     - name: Setup kubectl
-      uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
+      uses: azure/setup-kubectl@bda439f5f36b99b262ebdcd3613869bddb064c8e # v5.2.0
 
     - name: Setup helm
-      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      uses: azure/setup-helm@2f5e7bc67f1f9972ab16657bb795f36d8f04de0e # v5.1.0
 
     - name: AWS Login
       uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
diff --git a/.github/actions/promote-release/action.yml b/.github/actions/promote-release/action.yml
index 2c429814..dede1eb4 100644
--- a/.github/actions/promote-release/action.yml
+++ b/.github/actions/promote-release/action.yml
@@ -138,7 +138,7 @@ runs:
     # two modes get their own step.
     - name: Log in to GHCR
       if: inputs.dry-run != 'true'
-      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
       with:
         registry: ghcr.io
         username: ${{ inputs.docker-username }}
@@ -151,7 +151,7 @@ runs:
       id: ghcr-login-rehearsal
       if: inputs.dry-run == 'true'
       continue-on-error: true
-      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
       with:
         registry: ghcr.io
         username: ${{ inputs.docker-username }}
diff --git a/.github/actions/publish-helm-chart/action.yml b/.github/actions/publish-helm-chart/action.yml
index d7a47d0c..9a763788 100644
--- a/.github/actions/publish-helm-chart/action.yml
+++ b/.github/actions/publish-helm-chart/action.yml
@@ -51,7 +51,7 @@ runs:
   using: "composite"
   steps:
     - name: Set up Helm
-      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      uses: azure/setup-helm@2f5e7bc67f1f9972ab16657bb795f36d8f04de0e # v5.1.0
       with:
         version: ${{ inputs.helm-version }}
 
diff --git a/.github/actions/secret-broker-request/action.yml b/.github/actions/secret-broker-request/action.yml
index 70a481ea..06c2ca37 100644
--- a/.github/actions/secret-broker-request/action.yml
+++ b/.github/actions/secret-broker-request/action.yml
@@ -29,7 +29,7 @@ runs:
     - name: Create organization membership token
       id: app-token
       if: ${{ inputs.authorization == '' }}
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
       with:
         client-id: ${{ inputs.app-client-id }}
         private-key: ${{ inputs.app-private-key }}
diff --git a/.github/actions/semver-validation/action.yml b/.github/actions/semver-validation/action.yml
index 291d1f84..c8dbc942 100644
--- a/.github/actions/semver-validation/action.yml
+++ b/.github/actions/semver-validation/action.yml
@@ -127,7 +127,7 @@ runs:
 
     - name: Install cosign
       if: inputs.verify-signature == 'true' && steps.cosign.outputs.install == 'true'
-      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
     # setup-semstat's installer, run out of the checkout this action came in
     # rather than through `uses:`. Neither form of `uses:` works for a sibling in
diff --git a/.github/actions/setup-semstat/action.yml b/.github/actions/setup-semstat/action.yml
index 105c9ce5..4adf5a33 100644
--- a/.github/actions/setup-semstat/action.yml
+++ b/.github/actions/setup-semstat/action.yml
@@ -73,7 +73,7 @@ runs:
 
     - name: Install cosign
       if: inputs.verify-signature == 'true' && steps.cosign.outputs.install == 'true'
-      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
     - name: Install semstat
       id: install
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index 5a73459a..82d3380d 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Run actionlint with reviewdog
         if: steps.changed-files.outputs.workflows == 'true'
-        uses: reviewdog/action-actionlint@2085657ab2c7f48c58edcc767fba576f63bea76b # v1.77.0
+        uses: reviewdog/action-actionlint@ae857e78c1b42b3d0a49637181b09d3d56d402b4 # v1.84.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           reporter: ${{ inputs.reporter }}
diff --git a/.github/workflows/claude-code-review.yaml b/.github/workflows/claude-code-review.yaml
index 57f30689..b0906f0b 100644
--- a/.github/workflows/claude-code-review.yaml
+++ b/.github/workflows/claude-code-review.yaml
@@ -43,7 +43,7 @@ jobs:
           git show "origin/${BASE_REF}:CLAUDE.md" > CLAUDE.md 2>/dev/null || rm -f CLAUDE.md
 
       - name: Claude Code Review
-        uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1
+        uses: anthropics/claude-code-action@f3b070c88125d33dbae5653df5f143101d4ea9dc # v1
         with:
           anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml
index 9bad6d3e..9f9adb04 100644
--- a/.github/workflows/claude.yaml
+++ b/.github/workflows/claude.yaml
@@ -57,6 +57,6 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1
+        uses: anthropics/claude-code-action@f3b070c88125d33dbae5653df5f143101d4ea9dc # v1
         with:
           anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 3f817b43..c55771b4 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -63,7 +63,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1
+        uses: anthropics/claude-code-action@f3b070c88125d33dbae5653df5f143101d4ea9dc # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env] -- OAuth token for Claude, no dedicated environment needed
 
diff --git a/.github/workflows/fork-review-advisory.yaml b/.github/workflows/fork-review-advisory.yaml
index 3d452a98..ef52b77d 100644
--- a/.github/workflows/fork-review-advisory.yaml
+++ b/.github/workflows/fork-review-advisory.yaml
@@ -48,7 +48,7 @@ jobs:
         run: bash .github/actions/fork-review-check/src/check-access.sh configuration
       - name: Create fork-scoped read token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.FORK_REVIEW_APP_CLIENT_ID }}
           private-key: ${{ secrets.FORK_REVIEW_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/scheduled-cve-scan.yaml b/.github/workflows/scheduled-cve-scan.yaml
index 87218535..6b5f3409 100644
--- a/.github/workflows/scheduled-cve-scan.yaml
+++ b/.github/workflows/scheduled-cve-scan.yaml
@@ -77,7 +77,7 @@ jobs:
         id: upload
         if: always() && steps.cve-scan.outputs.sarif-path != ''
         # Do not add `category`: the scanner sets automationDetails.id, which upload-sarif keeps.
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: ${{ steps.cve-scan.outputs.sarif-path }}
 
diff --git a/.github/workflows/test-advance-action-tags.yaml b/.github/workflows/test-advance-action-tags.yaml
index 1b8a6532..6bf846ce 100644
--- a/.github/workflows/test-advance-action-tags.yaml
+++ b/.github/workflows/test-advance-action-tags.yaml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-ai-pr-review.yaml b/.github/workflows/test-ai-pr-review.yaml
index 9601442c..549c4e00 100644
--- a/.github/workflows/test-ai-pr-review.yaml
+++ b/.github/workflows/test-ai-pr-review.yaml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-ai-step.yaml b/.github/workflows/test-ai-step.yaml
index a995863d..47c08148 100644
--- a/.github/workflows/test-ai-step.yaml
+++ b/.github/workflows/test-ai-step.yaml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-auto-approve-bot-prs.yaml b/.github/workflows/test-auto-approve-bot-prs.yaml
index 36a48cab..bdd08c14 100644
--- a/.github/workflows/test-auto-approve-bot-prs.yaml
+++ b/.github/workflows/test-auto-approve-bot-prs.yaml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-aws-test-infra.yaml b/.github/workflows/test-aws-test-infra.yaml
index b0924bba..abfe1c4f 100644
--- a/.github/workflows/test-aws-test-infra.yaml
+++ b/.github/workflows/test-aws-test-infra.yaml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-backport-fix-imports.yaml b/.github/workflows/test-backport-fix-imports.yaml
index 47acec7f..e51e9104 100644
--- a/.github/workflows/test-backport-fix-imports.yaml
+++ b/.github/workflows/test-backport-fix-imports.yaml
@@ -22,7 +22,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run backport-fix-imports pytest
         run: uv run --with pytest==8.3.3 pytest .github/actions/backport-fix-imports/test/ -q
 
diff --git a/.github/workflows/test-backport-legacy-allowlist.yaml b/.github/workflows/test-backport-legacy-allowlist.yaml
index 8ddc36f1..1fa82e50 100644
--- a/.github/workflows/test-backport-legacy-allowlist.yaml
+++ b/.github/workflows/test-backport-legacy-allowlist.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-backport-legacy-split.yaml b/.github/workflows/test-backport-legacy-split.yaml
index 2951e92d..df217b0a 100644
--- a/.github/workflows/test-backport-legacy-split.yaml
+++ b/.github/workflows/test-backport-legacy-split.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-check-action-pins.yaml b/.github/workflows/test-check-action-pins.yaml
index 6563cedb..3eae9cc1 100644
--- a/.github/workflows/test-check-action-pins.yaml
+++ b/.github/workflows/test-check-action-pins.yaml
@@ -21,7 +21,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run tests
         run: make test-check-action-pins
       - name: Check repository action pins
diff --git a/.github/workflows/test-ci-test-notify.yaml b/.github/workflows/test-ci-test-notify.yaml
index d2e85fc1..45f4e5fb 100644
--- a/.github/workflows/test-ci-test-notify.yaml
+++ b/.github/workflows/test-ci-test-notify.yaml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-cleanup-head-charts.yaml b/.github/workflows/test-cleanup-head-charts.yaml
index 850e2ad8..d1cfd29c 100644
--- a/.github/workflows/test-cleanup-head-charts.yaml
+++ b/.github/workflows/test-cleanup-head-charts.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-comment-triggered-check.yaml b/.github/workflows/test-comment-triggered-check.yaml
index 3df4ae76..d13f5ba9 100644
--- a/.github/workflows/test-comment-triggered-check.yaml
+++ b/.github/workflows/test-comment-triggered-check.yaml
@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-commitlint.yaml b/.github/workflows/test-commitlint.yaml
index 1f2d4f64..96196050 100644
--- a/.github/workflows/test-commitlint.yaml
+++ b/.github/workflows/test-commitlint.yaml
@@ -20,7 +20,7 @@ jobs:
       # This action installs bats, it does not run anything. It has no `tests`
       # input, and an unknown input is a warning rather than an error, so a job
       # that only calls it passes without executing a single test.
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-conflict-check.yaml b/.github/workflows/test-conflict-check.yaml
index 54824065..a6349c73 100644
--- a/.github/workflows/test-conflict-check.yaml
+++ b/.github/workflows/test-conflict-check.yaml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-cve-scan.yaml b/.github/workflows/test-cve-scan.yaml
index 4cc22400..61d74483 100644
--- a/.github/workflows/test-cve-scan.yaml
+++ b/.github/workflows/test-cve-scan.yaml
@@ -19,7 +19,7 @@ jobs:
       # This action installs bats, it does not run anything. It has no `tests`
       # input, and an unknown input is a warning rather than an error, so a job
       # that only calls it passes without executing a single test.
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-delete-previous-head-image.yaml b/.github/workflows/test-delete-previous-head-image.yaml
index 349cd4d2..e42b6844 100644
--- a/.github/workflows/test-delete-previous-head-image.yaml
+++ b/.github/workflows/test-delete-previous-head-image.yaml
@@ -18,6 +18,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run delete-previous-head-image tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/delete-previous-head-image/test/ -q
diff --git a/.github/workflows/test-fork-review-check.yaml b/.github/workflows/test-fork-review-check.yaml
index 4859d57b..ed86ac69 100644
--- a/.github/workflows/test-fork-review-check.yaml
+++ b/.github/workflows/test-fork-review-check.yaml
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
@@ -50,7 +50,7 @@ jobs:
           file-install: false
       - name: Run fork-review-check action tests
         run: bats .github/actions/fork-review-check/test/*.bats
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-ghcr-tag-guard.yaml b/.github/workflows/test-ghcr-tag-guard.yaml
index 2e14a5e5..be88f93b 100644
--- a/.github/workflows/test-ghcr-tag-guard.yaml
+++ b/.github/workflows/test-ghcr-tag-guard.yaml
@@ -16,5 +16,5 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - run: make test-ghcr-tag-guard
diff --git a/.github/workflows/test-go-licenses.yaml b/.github/workflows/test-go-licenses.yaml
index d421b016..a2560459 100644
--- a/.github/workflows/test-go-licenses.yaml
+++ b/.github/workflows/test-go-licenses.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-govulncheck.yaml b/.github/workflows/test-govulncheck.yaml
index a81a3eee..44380f12 100644
--- a/.github/workflows/test-govulncheck.yaml
+++ b/.github/workflows/test-govulncheck.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-linear-cve-summary.yaml b/.github/workflows/test-linear-cve-summary.yaml
index 8add01d5..5326e699 100644
--- a/.github/workflows/test-linear-cve-summary.yaml
+++ b/.github/workflows/test-linear-cve-summary.yaml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run Linear CVE summary tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/linear-cve-summary/test/ -q
       - name: Start fake Linear server
diff --git a/.github/workflows/test-oss-commit-sync.yaml b/.github/workflows/test-oss-commit-sync.yaml
index 89f509b7..61d9ff2b 100644
--- a/.github/workflows/test-oss-commit-sync.yaml
+++ b/.github/workflows/test-oss-commit-sync.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-oss-mirror-staleness.yaml b/.github/workflows/test-oss-mirror-staleness.yaml
index 10439794..a84ecf38 100644
--- a/.github/workflows/test-oss-mirror-staleness.yaml
+++ b/.github/workflows/test-oss-mirror-staleness.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-parse-label-filter.yaml b/.github/workflows/test-parse-label-filter.yaml
index 0e342a0f..22356e99 100644
--- a/.github/workflows/test-parse-label-filter.yaml
+++ b/.github/workflows/test-parse-label-filter.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-platform-release.yaml b/.github/workflows/test-platform-release.yaml
index 55cf8c3c..d4c73c0e 100644
--- a/.github/workflows/test-platform-release.yaml
+++ b/.github/workflows/test-platform-release.yaml
@@ -21,7 +21,7 @@ jobs:
       # This action installs bats, it does not run anything. It has no `tests`
       # input, and an unknown input is a warning rather than an error, so a job
       # that only calls it passes without executing a single test.
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-prerelease-setup.yaml b/.github/workflows/test-prerelease-setup.yaml
index 8191fca3..82c64147 100644
--- a/.github/workflows/test-prerelease-setup.yaml
+++ b/.github/workflows/test-prerelease-setup.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-promote-release.yaml b/.github/workflows/test-promote-release.yaml
index 4c35025a..cc700d69 100644
--- a/.github/workflows/test-promote-release.yaml
+++ b/.github/workflows/test-promote-release.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-publish-helm-chart.yaml b/.github/workflows/test-publish-helm-chart.yaml
index 2825975f..f829b28d 100644
--- a/.github/workflows/test-publish-helm-chart.yaml
+++ b/.github/workflows/test-publish-helm-chart.yaml
@@ -20,7 +20,7 @@ jobs:
         with:
           # renovate: datasource=github-releases depName=mikefarah/yq
           version: v4.53.6
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-release-branch-freeze.yaml b/.github/workflows/test-release-branch-freeze.yaml
index 7733d214..e1ec3a77 100644
--- a/.github/workflows/test-release-branch-freeze.yaml
+++ b/.github/workflows/test-release-branch-freeze.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-release-notification.yaml b/.github/workflows/test-release-notification.yaml
index eba08d0b..739b7f0a 100644
--- a/.github/workflows/test-release-notification.yaml
+++ b/.github/workflows/test-release-notification.yaml
@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run release-notification pytest
         run: uv run --with pytest==8.3.3 pytest .github/actions/release-notification/test/ -q
 
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-release-on-merge.yaml b/.github/workflows/test-release-on-merge.yaml
index 398ff49a..ac4d6af8 100644
--- a/.github/workflows/test-release-on-merge.yaml
+++ b/.github/workflows/test-release-on-merge.yaml
@@ -21,6 +21,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run release-on-merge tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/release-on-merge/test -q
diff --git a/.github/workflows/test-release-summary.yaml b/.github/workflows/test-release-summary.yaml
index 362356e4..5aecdb1b 100644
--- a/.github/workflows/test-release-summary.yaml
+++ b/.github/workflows/test-release-summary.yaml
@@ -22,7 +22,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run release-summary pytest
         run: uv run --with pytest==8.3.3 pytest .github/actions/release-summary/test/ -q
 
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-repository-dispatch.yaml b/.github/workflows/test-repository-dispatch.yaml
index 959e8f13..37fcd055 100644
--- a/.github/workflows/test-repository-dispatch.yaml
+++ b/.github/workflows/test-repository-dispatch.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-resolve-github-release.yaml b/.github/workflows/test-resolve-github-release.yaml
index 4f5018d7..fa80a740 100644
--- a/.github/workflows/test-resolve-github-release.yaml
+++ b/.github/workflows/test-resolve-github-release.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-resolve-pr-event.yaml b/.github/workflows/test-resolve-pr-event.yaml
index 16b37aa5..fd28b754 100644
--- a/.github/workflows/test-resolve-pr-event.yaml
+++ b/.github/workflows/test-resolve-pr-event.yaml
@@ -35,6 +35,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/resolve-pr-event/test/ -q
diff --git a/.github/workflows/test-retry-approved-pr-ci.yaml b/.github/workflows/test-retry-approved-pr-ci.yaml
index f37c2060..199ec1f6 100644
--- a/.github/workflows/test-retry-approved-pr-ci.yaml
+++ b/.github/workflows/test-retry-approved-pr-ci.yaml
@@ -20,6 +20,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run retry policy tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/retry-approved-pr-ci/test/ -q
diff --git a/.github/workflows/test-run-ginkgo.yaml b/.github/workflows/test-run-ginkgo.yaml
index 11fb6284..0fd5663d 100644
--- a/.github/workflows/test-run-ginkgo.yaml
+++ b/.github/workflows/test-run-ginkgo.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-secret-broker-request.yaml b/.github/workflows/test-secret-broker-request.yaml
index 438a1da2..ccbd93ea 100644
--- a/.github/workflows/test-secret-broker-request.yaml
+++ b/.github/workflows/test-secret-broker-request.yaml
@@ -18,6 +18,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run secret broker request tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/secret-broker-request/test/ -q
diff --git a/.github/workflows/test-secret-broker-response.yaml b/.github/workflows/test-secret-broker-response.yaml
index 72952f96..e0902631 100644
--- a/.github/workflows/test-secret-broker-response.yaml
+++ b/.github/workflows/test-secret-broker-response.yaml
@@ -18,6 +18,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run secret broker response tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/secret-broker-response/test/ -q
diff --git a/.github/workflows/test-select-backport-source-prs.yaml b/.github/workflows/test-select-backport-source-prs.yaml
index 552adbb6..9cb029a1 100644
--- a/.github/workflows/test-select-backport-source-prs.yaml
+++ b/.github/workflows/test-select-backport-source-prs.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-semver-validation.yaml b/.github/workflows/test-semver-validation.yaml
index 5b35c89a..f5c96923 100644
--- a/.github/workflows/test-semver-validation.yaml
+++ b/.github/workflows/test-semver-validation.yaml
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-setup-semstat.yaml b/.github/workflows/test-setup-semstat.yaml
index 85fdf827..b332fd1a 100644
--- a/.github/workflows/test-setup-semstat.yaml
+++ b/.github/workflows/test-setup-semstat.yaml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-sticky-pr-comment.yaml b/.github/workflows/test-sticky-pr-comment.yaml
index 396b7141..114a4ffc 100644
--- a/.github/workflows/test-sticky-pr-comment.yaml
+++ b/.github/workflows/test-sticky-pr-comment.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-subtree-mirror.yaml b/.github/workflows/test-subtree-mirror.yaml
index 4c68c934..c84f08bc 100644
--- a/.github/workflows/test-subtree-mirror.yaml
+++ b/.github/workflows/test-subtree-mirror.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-testing-tailnet.yaml b/.github/workflows/test-testing-tailnet.yaml
index 87c667fb..a7e0756a 100644
--- a/.github/workflows/test-testing-tailnet.yaml
+++ b/.github/workflows/test-testing-tailnet.yaml
@@ -15,6 +15,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Run testing tailnet tests
         run: uv run --with pytest==8.3.3 pytest .github/actions/testing-tailnet/test/ -q
diff --git a/.github/workflows/test-vcluster-release.yaml b/.github/workflows/test-vcluster-release.yaml
index a1f5cf1e..a8fb80d0 100644
--- a/.github/workflows/test-vcluster-release.yaml
+++ b/.github/workflows/test-vcluster-release.yaml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false
diff --git a/.github/workflows/test-wait-for-release.yaml b/.github/workflows/test-wait-for-release.yaml
index d8790f5c..13af4ddf 100644
--- a/.github/workflows/test-wait-for-release.yaml
+++ b/.github/workflows/test-wait-for-release.yaml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+      - uses: bats-core/bats-action@3566550e0f594451ac0f58fcbfdeca93aa29a45e # 4.1.0
         with:
           support-install: false
           assert-install: false