diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index c7961c8..48b3c08 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -15,4 +15,4 @@ permissions:
 
 jobs:
   dependabot-bun-dedupe:
-    uses: stella/.github/.github/workflows/dependabot-bun-dedupe.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/dependabot-bun-dedupe.yml@042baebaf071329b956555c05caf5736504c278d
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index a19a2bf..4ba1443 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -34,7 +34,7 @@ jobs:
           || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
         )
       )
-    uses: stella/.github/.github/workflows/cla.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/cla.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       allowlist: dependabot[bot],renovate[bot],github-actions[bot],google-labs-jules[bot],cursoragent,stella-provenance-updater[bot],autofix-ci[bot]
     secrets:
diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml
index 789ddc4..6012b9c 100644
--- a/.github/workflows/quarantine-policy.yml
+++ b/.github/workflows/quarantine-policy.yml
@@ -15,4 +15,4 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@042baebaf071329b956555c05caf5736504c278d
diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml
index 0f36df9..956b20f 100644
--- a/.github/workflows/quarantine-prune.yml
+++ b/.github/workflows/quarantine-prune.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'stella/stdnum'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@042baebaf071329b956555c05caf5736504c278d
     secrets:
       CHANGELOG_APP_ID: ${{ secrets.CHANGELOG_APP_ID }}
       CHANGELOG_APP_PRIVATE_KEY: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index 9e5d30f..2e947d6 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -18,6 +18,6 @@ permissions:
 jobs:
   enforce:
     name: Enforce release boundaries
-    uses: stella/.github/.github/workflows/release-policy.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/release-policy.yml@042baebaf071329b956555c05caf5736504c278d
     permissions:
       contents: read
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 7858e79..5e1a90b 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -17,7 +17,7 @@ jobs:
       contents: read
       pull-requests: read
       checks: read
-    uses: stella/.github/.github/workflows/changeset-release-pr.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/changeset-release-pr.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       bun-version-file: package.json
       sync-cargo-inherited-lock: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44d60a8..3d4e5d3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -334,7 +334,7 @@ jobs:
       id-token: write # Required only for PyPI trusted publishing.
     steps:
       - name: Prepare exact Python wheel set
-        uses: stella/.github/.github/actions/pypi-publish-hardened@ba5f7da76aededf6f22814de93c72a49843fcc8e
+        uses: stella/.github/.github/actions/pypi-publish-hardened@042baebaf071329b956555c05caf5736504c278d
         with:
           expected-version: ${{ needs.verify.outputs.version }}
           project-name: stella-stdnum
@@ -347,7 +347,7 @@ jobs:
           packages-dir: dist
           skip-existing: true
       - name: Verify published PyPI files
-        uses: stella/.github/.github/actions/pypi-publish-hardened/verify@ba5f7da76aededf6f22814de93c72a49843fcc8e
+        uses: stella/.github/.github/actions/pypi-publish-hardened/verify@042baebaf071329b956555c05caf5736504c278d
         with:
           expected-version: ${{ needs.verify.outputs.version }}
           project-name: stella-stdnum
@@ -356,7 +356,7 @@ jobs:
     name: Finalize release
     needs: [verify, pack-native, pack-portable, publish-pypi]
     if: github.ref == 'refs/heads/main' && (needs.verify.outputs.publish == 'true')
-    uses: stella/.github/.github/workflows/npm-version-finalize.yml@ba5f7da76aededf6f22814de93c72a49843fcc8e
+    uses: stella/.github/.github/workflows/npm-version-finalize.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       package-files: |
         packages/stdnum/package.json