diff --git a/.github/workflows/ai-claude.yml b/.github/workflows/ai-claude.yml
index ad9a79b..c65ef57 100644
--- a/.github/workflows/ai-claude.yml
+++ b/.github/workflows/ai-claude.yml
@@ -57,6 +57,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1.0.233
+      - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
diff --git a/.github/workflows/ci-ansible-collection.yml b/.github/workflows/ci-ansible-collection.yml
index bdd742a..e7876f3 100644
--- a/.github/workflows/ci-ansible-collection.yml
+++ b/.github/workflows/ci-ansible-collection.yml
@@ -327,7 +327,7 @@ jobs:
         run: ansible-galaxy collection build
 
       - name: Upload collection artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: collection
           path: "*.tar.gz"
diff --git a/.github/workflows/ci-ansible-molecule.yml b/.github/workflows/ci-ansible-molecule.yml
index 4c1b911..4df8306 100644
--- a/.github/workflows/ci-ansible-molecule.yml
+++ b/.github/workflows/ci-ansible-molecule.yml
@@ -298,7 +298,7 @@ jobs:
 
       - name: Upload molecule log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: molecule-log-${{ inputs.concurrency-suffix != '' && format('{0}-', inputs.concurrency-suffix) || '' }}${{ inputs.driver }}-${{ matrix.scenario }}
           path: ${{ env.MOLECULE_LOG }}
diff --git a/.github/workflows/ci-go.yml b/.github/workflows/ci-go.yml
index 98bdb4e..26cc025 100644
--- a/.github/workflows/ci-go.yml
+++ b/.github/workflows/ci-go.yml
@@ -121,7 +121,7 @@ jobs:
           echo "Test coverage: $COVERAGE"
 
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-report
           path: coverage.html
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
index 6d1b4f8..8274f75 100644
--- a/.github/workflows/ci-lint.yml
+++ b/.github/workflows/ci-lint.yml
@@ -44,7 +44,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run actionlint
-        uses: reviewdog/action-actionlint@2085657ab2c7f48c58edcc767fba576f63bea76b # v1
+        uses: reviewdog/action-actionlint@419a49378266e892f40c773b4f2fc6de9aa87499 # v1
         with:
           reporter: github-pr-review
           fail_level: error
@@ -59,7 +59,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run shellcheck
-        uses: reviewdog/action-shellcheck@0a90156c6e0553996a217f0a9e09be6b0f6bee4c # v1
+        uses: reviewdog/action-shellcheck@d0b8d5fd7fad6afdb6e1b6ce1778892be4d1f427 # v1
         with:
           reporter: github-pr-review
           fail_level: error
diff --git a/.github/workflows/cleanup-container-registry.yml b/.github/workflows/cleanup-container-registry.yml
index b1872fa..fe5dbd9 100644
--- a/.github/workflows/cleanup-container-registry.yml
+++ b/.github/workflows/cleanup-container-registry.yml
@@ -185,7 +185,7 @@ jobs:
           fi
 
       - name: Upload Cleanup Report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: cleanup-report
           path: cleanup-report.md
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index d330523..723e642 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -212,7 +212,7 @@ jobs:
       # prose comments — hence a YAML parser rather than a plain shell scan.
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
-          python-version: '3.14.7'
+          python-version: '3.15.0'
       - name: Install pyyaml
         run: python3 -m pip install --disable-pip-version-check pyyaml
       - name: Assert caller inputs reach shell bodies through env
diff --git a/.github/workflows/release-go.yml b/.github/workflows/release-go.yml
index b4f9546..c7283b2 100644
--- a/.github/workflows/release-go.yml
+++ b/.github/workflows/release-go.yml
@@ -99,7 +99,7 @@ jobs:
           echo "$EXTRA_ENV" >> "$GITHUB_ENV"
 
       - name: Create release with GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           distribution: goreleaser
           version: ${{ inputs.goreleaser-version }}
diff --git a/.github/workflows/security-code.yml b/.github/workflows/security-code.yml
index 26f8094..eb9fac4 100644
--- a/.github/workflows/security-code.yml
+++ b/.github/workflows/security-code.yml
@@ -117,7 +117,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
@@ -160,7 +160,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.language == 'javascript-typescript'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: ${{ inputs.node-version-file }}
           cache: ${{ steps.detect-pm.outputs.manager }}
@@ -234,10 +234,10 @@ jobs:
 
       - name: Autobuild
         if: inputs.build-command == '' && matrix.language != 'javascript-typescript' && matrix.language != 'python'
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: '/language:${{ matrix.language }}'
           upload: ${{ inputs.enable-sarif-upload && 'always' || 'never' }}
@@ -245,7 +245,7 @@ jobs:
 
       - name: Upload SARIF as artifact
         if: ${{ !inputs.enable-sarif-upload }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codeql-sarif-${{ matrix.language }}
           path: codeql-results/*.sarif
diff --git a/.github/workflows/security-config.yml b/.github/workflows/security-config.yml
index df561f7..898aa24 100644
--- a/.github/workflows/security-config.yml
+++ b/.github/workflows/security-config.yml
@@ -117,7 +117,7 @@ jobs:
         if: |
           inputs.enable-sarif && always() &&
           steps.repo.outputs.visibility == 'public'
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: 'trivy-config-results.sarif'
           category: 'trivy-config'
@@ -146,7 +146,7 @@ jobs:
 
       - name: Upload Trivy artifacts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: trivy-config-results
           path: |
@@ -205,7 +205,7 @@ jobs:
           inputs.enable-sarif && always() &&
           steps.sarif_check.outputs.exists == 'true' &&
           steps.repo.outputs.visibility == 'public'
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: 'trivy-results.sarif'
           category: 'trivy-terraform'
@@ -224,7 +224,7 @@ jobs:
 
       - name: Upload Trivy artifacts
         if: always() && steps.sarif_check.outputs.exists == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: trivy-terraform-results
           path: trivy-results.sarif
@@ -339,7 +339,7 @@ jobs:
 
       - name: Upload Kubernetes scan results
         if: steps.find-manifests.outputs.found == 'true' && always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: kubernetes-security-results
           path: |
@@ -362,7 +362,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.14.7'
+          python-version: '3.15.0'
 
       - name: Install Ansible and ansible-lint
         env:
@@ -392,7 +392,7 @@ jobs:
 
       - name: Upload Ansible scan results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ansible-security-results
           path: |
diff --git a/.github/workflows/security-deps.yml b/.github/workflows/security-deps.yml
index 7170990..f498493 100644
--- a/.github/workflows/security-deps.yml
+++ b/.github/workflows/security-deps.yml
@@ -123,7 +123,7 @@ jobs:
 
       - name: Upload audit results
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: go-audit-results
           path: |
diff --git a/.github/workflows/security-sbom.yml b/.github/workflows/security-sbom.yml
index c28b070..5003002 100644
--- a/.github/workflows/security-sbom.yml
+++ b/.github/workflows/security-sbom.yml
@@ -85,7 +85,7 @@ jobs:
       # Container Image SBOM
       - name: Generate SBOM for container image
         if: inputs.artifact-type == 'container'
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: ${{ inputs.artifact-ref }}
           format: ${{ inputs.sbom-format }}
@@ -94,7 +94,7 @@ jobs:
       # Filesystem SBOM
       - name: Generate SBOM for filesystem
         if: inputs.artifact-type == 'filesystem'
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           path: ${{ inputs.artifact-ref }}
           format: ${{ inputs.sbom-format }}
@@ -138,7 +138,7 @@ jobs:
           fi
 
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sbom-${{ inputs.artifact-type }}
           path: ${{ steps.sbom-output.outputs.file }}
@@ -192,7 +192,7 @@ jobs:
     if: always() && !cancelled()
     steps:
       - name: Download SBOM
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: sbom-${{ inputs.artifact-type }}
           path: ./sbom
diff --git a/.github/workflows/security-secrets.yml b/.github/workflows/security-secrets.yml
index 5e7559f..7bdebab 100644
--- a/.github/workflows/security-secrets.yml
+++ b/.github/workflows/security-secrets.yml
@@ -91,7 +91,7 @@ jobs:
           persist-credentials: false
 
       - name: Run TruffleHog
-        uses: trufflesecurity/trufflehog@a5f3de55cc2065ae4dde8fee24076f137fd62fcf # v3.97.8
+        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
         with:
           path: ${{ inputs.working-directory }}
           base: ${{ github.event.before || 'HEAD~1' }}
diff --git a/.github/workflows/security-trivy.yml b/.github/workflows/security-trivy.yml
index 0ee30a5..b0f7f7a 100644
--- a/.github/workflows/security-trivy.yml
+++ b/.github/workflows/security-trivy.yml
@@ -129,6 +129,6 @@ jobs:
           fetch-depth: 0
 
       - name: Run TruffleHog
-        uses: trufflesecurity/trufflehog@a5f3de55cc2065ae4dde8fee24076f137fd62fcf # v3.97.8
+        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
         with:
           extra_args: --only-verified