diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index ad8bb32f0f7..ac0541fbcd6 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -356,7 +356,7 @@ jobs:
       - &checkout-mirror
         name: Checkout code (mirror)
         if: (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
       - &checkout-plain
         name: Checkout code
         if: (vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith') || github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
@@ -578,7 +578,7 @@ jobs:
       # Same provider/trust split as the build jobs' checkout.
       - name: Checkout code (mirror)
         if: (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 2
       - name: Checkout code
@@ -787,7 +787,7 @@ jobs:
     steps:
       - name: Checkout code (mirror)
         if: needs.changes.outputs.test_app == 'true' && (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 2
       - name: Checkout code
diff --git a/.github/workflows/docs-negotiation.yml b/.github/workflows/docs-negotiation.yml
index 14a52a52206..b25046e36e7 100644
--- a/.github/workflows/docs-negotiation.yml
+++ b/.github/workflows/docs-negotiation.yml
@@ -357,18 +357,18 @@ jobs:
         run: tar -I zstd -xf docs-build.tar.zst -C apps/docs
       - name: Set up Java for copied request examples
         if: matrix.group == 'http'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '17'
       - name: Set up .NET for copied request examples
         if: matrix.group == 'http'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '8.0.x'
       - name: Set up Go for copied request examples
         if: matrix.group == 'http'
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.25.x'
           cache: false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b11e5b4f7fd..f9f8d3aeb92 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -79,7 +79,7 @@ jobs:
       # Database IP restrictions admit the tailnet's app connector; see migrate.yml.
       - name: Join the tailnet
         if: vars.CI_DB_TAILNET == 'true'
-        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
+        uses: tailscale/github-action@064b10558093f38325e838ddea35486bdc6b1d5c # v4.4.0
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           audience: ${{ secrets.TS_AUDIENCE }}
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 85fa8dec01d..2988995c3c0 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Checkout code (mirror)
         if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with: &chart-checkout-options
           # Chart version checks need full history to compare against the PR base.
           fetch-depth: 0
@@ -403,7 +403,7 @@ jobs:
           push-to-registry: true
 
       - name: Set up ORAS
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
 
       # Artifact Hub reads repository metadata from the reserved `artifacthub.io`
       # tag on the chart's own OCI repository. Pushed on every run, including
@@ -511,7 +511,7 @@ jobs:
       # packages stay reachable no matter which domain serves the index.
       - name: Run chart-releaser
         if: steps.pages.outputs.exists == 'true'
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        uses: helm/chart-releaser-action@92c6b97fa9f664492a2592e0d1d80bc6bf378957 # v1.9.0
         with:
           charts_dir: helm
           # Re-running on an already-released version must be a no-op, the same
diff --git a/.github/workflows/migrate.yml b/.github/workflows/migrate.yml
index fcad4344b40..860ea110b23 100644
--- a/.github/workflows/migrate.yml
+++ b/.github/workflows/migrate.yml
@@ -87,7 +87,7 @@ jobs:
       # makes `tailscale up` reject the duplicate flag.
       - name: Join the tailnet
         if: vars.CI_DB_TAILNET == 'true'
-        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
+        uses: tailscale/github-action@064b10558093f38325e838ddea35486bdc6b1d5c # v4.4.0
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           audience: ${{ secrets.TS_AUDIENCE }}