diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index fe779b875b..4b4d2d7add 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -51,7 +51,7 @@ jobs:
 
       - name: Run Claude Code review
         if: steps.pr_metadata.outputs.is_cross_repository != 'true'
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+        uses: anthropics/claude-code-action@e8c2d7c16c018cf1e694711c1c07a5f5db2b5eb1 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           allowed_bots: "ironclaw-ci[bot]"
diff --git a/.github/workflows/code_style.yml b/.github/workflows/code_style.yml
index 3d0029a578..5ce24557b9 100644
--- a/.github/workflows/code_style.yml
+++ b/.github/workflows/code_style.yml
@@ -429,7 +429,7 @@ jobs:
           webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
           cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: clippy
           # Keep saves to protected-branch and merge_group runs so the ~10 GB
@@ -553,7 +553,7 @@ jobs:
           webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
           cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: windows-${{ matrix.name }}
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -576,7 +576,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: reborn-cli-smoke
           # Keep saves to protected-branch and merge_group runs so the ~10 GB
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 71c77ce929..bbc9f8d7c8 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -120,7 +120,7 @@ jobs:
           components: llvm-tools-preview
           targets: wasm32-wasip2
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: coverage-llvm21-${{ matrix.name }}
 
@@ -232,7 +232,7 @@ jobs:
           components: llvm-tools-preview
           targets: wasm32-wasip2
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: e2e-coverage-llvm21
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3668066bad..7bebfc50b9 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -146,7 +146,7 @@ jobs:
           echo "target=runtime" >> "$GITHUB_OUTPUT"
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ vars.DOCKER_REGISTRY_USER }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
@@ -176,7 +176,7 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.check.outputs.skip != 'true'
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push (ironclaw)
         if: steps.check.outputs.skip != 'true'
diff --git a/.github/workflows/ironclaw-release.yml b/.github/workflows/ironclaw-release.yml
index 4d9fa284fa..918b524f04 100644
--- a/.github/workflows/ironclaw-release.yml
+++ b/.github/workflows/ironclaw-release.yml
@@ -143,7 +143,7 @@ jobs:
       - name: "Enable pnpm"
         run: "corepack enable pnpm"
         shell: "bash"
-      - uses: swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+      - uses: swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16
         with:
           key: ${{ join(matrix.targets, '-') }}
           cache-provider: ${{ matrix.cache_provider }}
diff --git a/.github/workflows/ironclaw-stress.yml b/.github/workflows/ironclaw-stress.yml
index c661617e05..1d17afd2f2 100644
--- a/.github/workflows/ironclaw-stress.yml
+++ b/.github/workflows/ironclaw-stress.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Install Rust
         uses: ./.github/actions/setup-rust
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: ironclaw-stress-libsql
           save-if: ${{ github.event_name == 'schedule' || github.event_name == 'merge_group' }}
@@ -142,7 +142,7 @@ jobs:
       - name: Install Rust
         uses: ./.github/actions/setup-rust
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: ironclaw-stress-ramp
           save-if: ${{ github.event_name == 'schedule' }}
@@ -187,7 +187,7 @@ jobs:
           persist-credentials: false
       - name: Install Rust
         uses: ./.github/actions/setup-rust
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: ironclaw-stress-soak
           save-if: ${{ github.event_name == 'schedule' }}
@@ -252,7 +252,7 @@ jobs:
           cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: ironclaw-stress-libsql-scripted
           save-if: ${{ github.event_name == 'schedule' }}
@@ -469,7 +469,7 @@ jobs:
           cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: ironclaw-stress-postgres-api
           save-if: ${{ github.event_name == 'schedule' }}
diff --git a/.github/workflows/live-canary.yml b/.github/workflows/live-canary.yml
index a257107681..fc97aaa91a 100644
--- a/.github/workflows/live-canary.yml
+++ b/.github/workflows/live-canary.yml
@@ -403,7 +403,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         with:
           targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: live-canary-workflow-canary
       - name: Setup OVH sccache
@@ -451,7 +451,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         with:
           targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: live-canary-deterministic-replay
       - name: Setup OVH sccache
@@ -505,7 +505,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         with:
           targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: live-canary-public-smoke
       - name: Setup OVH sccache
@@ -783,7 +783,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         if: steps.lookup.outputs.found != '1'
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         if: steps.lookup.outputs.found != '1'
         with:
           key: live-canary-reborn-webui-v2-live-qa
@@ -1240,7 +1240,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         with:
           targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: live-canary-persona-rotating
       - name: Setup OVH sccache
@@ -1353,7 +1353,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         with:
           targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: live-canary-release-public-full
       - name: Setup OVH sccache
@@ -1404,7 +1404,7 @@ jobs:
       - uses: ./.github/actions/setup-rust
         with:
           targets: wasm32-wasip2
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: live-canary-upgrade
       - name: Setup OVH sccache
diff --git a/.github/workflows/openwiki-update.yml b/.github/workflows/openwiki-update.yml
index ccea8f9f85..7ef8bfe32f 100644
--- a/.github/workflows/openwiki-update.yml
+++ b/.github/workflows/openwiki-update.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/platform-and-compat.yml b/.github/workflows/platform-and-compat.yml
index c97d5272df..2d45b6ebf2 100644
--- a/.github/workflows/platform-and-compat.yml
+++ b/.github/workflows/platform-and-compat.yml
@@ -173,7 +173,7 @@ jobs:
           persist-credentials: false
       - name: Install Rust
         uses: ./.github/actions/setup-rust
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: hooks-parity
           # Keep saves to protected-branch and merge_group runs so the ~10 GB
@@ -224,7 +224,7 @@ jobs:
           persist-credentials: false
       - name: Install Rust
         uses: ./.github/actions/setup-rust
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: windows-${{ matrix.name }}
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -277,7 +277,7 @@ jobs:
           webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
           cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: wasm-extensions
           # Keep saves to protected-branch and merge_group runs so the ~10 GB
@@ -328,7 +328,7 @@ jobs:
           webui_dir="$(bash scripts/ci/crate-dir.sh ironclaw_webui)"
           cd "${webui_dir}/frontend"
           pnpm install --frozen-lockfile
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: bench
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/reborn-e2e.yml b/.github/workflows/reborn-e2e.yml
index 249388e217..909d8a2012 100644
--- a/.github/workflows/reborn-e2e.yml
+++ b/.github/workflows/reborn-e2e.yml
@@ -156,7 +156,7 @@ jobs:
           mold: true
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: reborn-e2e-${{ matrix.group }}
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -235,7 +235,7 @@ jobs:
           cache-dependency-path: tests/e2e/pyproject.toml
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: reborn-e2e-webui-v2-smoke
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
@@ -505,7 +505,7 @@ jobs:
 
       - name: Install Node.js for Emulate
         if: matrix.kind == 'provider'
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4
         with:
           node-version: "24"
           cache: "pnpm"
diff --git a/.github/workflows/reborn-playwright.yml b/.github/workflows/reborn-playwright.yml
index 94a34042df..c3e37c41a3 100644
--- a/.github/workflows/reborn-playwright.yml
+++ b/.github/workflows/reborn-playwright.yml
@@ -77,7 +77,7 @@ jobs:
           pnpm install --frozen-lockfile
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: reborn-playwright
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
diff --git a/.github/workflows/reborn-release-compile.yml b/.github/workflows/reborn-release-compile.yml
index e69fda6372..41959e8406 100644
--- a/.github/workflows/reborn-release-compile.yml
+++ b/.github/workflows/reborn-release-compile.yml
@@ -96,7 +96,7 @@ jobs:
           echo "$CC_ENV" >> "$GITHUB_ENV"
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: reborn-release-${{ matrix.target }}
           cache-on-failure: true
diff --git a/.github/workflows/reborn-tests.yml b/.github/workflows/reborn-tests.yml
index 1486663e8b..c648729ef6 100644
--- a/.github/workflows/reborn-tests.yml
+++ b/.github/workflows/reborn-tests.yml
@@ -352,7 +352,7 @@ jobs:
           pnpm install --frozen-lockfile
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           # ONE shared cache for all ~60 crate-test jobs instead of a per-crate
           # key. Per-crate keys produced ~60 caches (registry + target each,
@@ -507,7 +507,7 @@ jobs:
           mold: true
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           # All 4 root partitions compile the *same* root-package build (they
           # only run different test partitions), so one shared cache is strictly
@@ -561,7 +561,7 @@ jobs:
           mold: true
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           shared-key: reborn-sandbox-docker-tests
           save-if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'merge_group' }}
@@ -681,7 +681,7 @@ jobs:
           pnpm install --frozen-lockfile
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           # ONE shared key across all 5 instrumented lanes: they all
           # instrument the same workspace build, so a per-lane key would just
@@ -989,7 +989,7 @@ jobs:
           pnpm install --frozen-lockfile
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           key: reborn-qa-recorded-fixtures
           save-if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'merge_group' }}
diff --git a/.github/workflows/rebuild-release-image.yml b/.github/workflows/rebuild-release-image.yml
index e33d43510a..04a13cd168 100644
--- a/.github/workflows/rebuild-release-image.yml
+++ b/.github/workflows/rebuild-release-image.yml
@@ -72,10 +72,10 @@ jobs:
           echo "sha=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ vars.DOCKER_REGISTRY_USER }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index bf8cec8bb9..2b1005e218 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -25,7 +25,7 @@ jobs:
       - &install-rust
         name: Install Rust toolchain
         uses: ./.github/actions/setup-rust
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
       # Generating a GitHub token, so that PRs and tags created by
       # the release-plz-action can trigger actions workflows.
       - name: Generate GitHub token
@@ -59,7 +59,7 @@ jobs:
     steps:
       - *checkout
       - *install-rust
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
       - name: Generate GitHub token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: generate-token