diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 489729a5..1dbf7a51 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Enforce release intent
         # The repository owner publishes this versioned shared contract.
-        uses: stella/.github/.github/actions/changeset-policy@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+        uses: stella/.github/.github/actions/changeset-policy@042baebaf071329b956555c05caf5736504c278d
         with:
           release-paths: ${{ steps.release-packages.outputs.release-paths }}
           generated-paths: ${{ steps.release-packages.outputs.generated-paths }}
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 61d67103..a5812879 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -28,7 +28,7 @@ jobs:
           || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
         )
       )
-    uses: stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/cla.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       allowlist: dependabot[bot],renovate[bot],github-actions[bot],stella-provenance-updater[bot],google-labs-jules[bot],cursoragent
     secrets:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c7f91cdd..d1da62f3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -134,7 +134,7 @@ jobs:
       contents: write
       id-token: write
     # Keep this caller filename stable: npm trusted publishing authorizes it.
-    uses: stella/.github/.github/workflows/npm-independent-release.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/npm-independent-release.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       artifact-run-id: ${{ inputs.artifact_run_id || '' }}
       artifact-pattern: npm-tarball-*
diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml
index ca57208a..b1138c5f 100644
--- a/.github/workflows/quarantine-policy.yml
+++ b/.github/workflows/quarantine-policy.yml
@@ -15,4 +15,4 @@ jobs:
     if: github.repository == 'stella/tooling'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@042baebaf071329b956555c05caf5736504c278d
diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml
index 4bff4ce1..c0fcc493 100644
--- a/.github/workflows/quarantine-prune.yml
+++ b/.github/workflows/quarantine-prune.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'stella/tooling'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@042baebaf071329b956555c05caf5736504c278d
     secrets:
       CHANGELOG_APP_ID: ${{ secrets.CHANGELOG_APP_ID }}
       CHANGELOG_APP_PRIVATE_KEY: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index bd521aeb..14b33a70 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -20,6 +20,6 @@ jobs:
     name: Enforce release boundaries
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/release-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/release-policy.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       workflow: .github/workflows/publish.yml
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 0731a139..546d8186 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -20,7 +20,7 @@ jobs:
       pull-requests: read
       checks: read
     # The repository owner publishes this versioned shared contract.
-    uses: stella/.github/.github/workflows/changeset-release-pr.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/changeset-release-pr.yml@042baebaf071329b956555c05caf5736504c278d
     with:
       bun-version-file: package.json
     secrets: