diff --git a/.github/workflows/clear-action-cache.yaml b/.github/workflows/clear-action-cache.yaml
index a410ed1..8b3ea9b 100644
--- a/.github/workflows/clear-action-cache.yaml
+++ b/.github/workflows/clear-action-cache.yaml
@@ -51,7 +51,7 @@ jobs:
     permissions:
       actions: write  # list and delete repository Actions caches
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml@9d4a5d5b7e30bcd26a0abffb5bf263fd11c13852  # v0.5.0
+    uses: lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml@04672a980550ff9bd89d24bacd39fb03e25b0b0b  # v0.6.1
     with:
       key_pattern: ${{ inputs.key_pattern }}
       ref_filter: ${{ inputs.ref_filter }}
diff --git a/.github/workflows/docs-audit.yaml b/.github/workflows/docs-audit.yaml
index dc2d99e..b9064f5 100644
--- a/.github/workflows/docs-audit.yaml
+++ b/.github/workflows/docs-audit.yaml
@@ -119,7 +119,7 @@ on:
         required: false
         type: string
         # yamllint disable-line rule:line-length
-        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@084d6861688632b2edb6bde3c180145bebf9cc7a'  # v0.17.2
+        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@6d4a65c5601afd6c2fbe52bda4b0024b132f265d'  # v0.19.0
 
     outputs:
       passed:
@@ -167,7 +167,7 @@ jobs:
       - name: 'Checkout Gerrit change'
         if: inputs.gerrit_refspec != ''
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093  # v1.1.2
+        uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a  # v1.2.1
         with:
           gerrit-refspec: ${{ inputs.gerrit_refspec }}
           gerrit-project: ${{ inputs.gerrit_project }}
diff --git a/.github/workflows/docs-build.yaml b/.github/workflows/docs-build.yaml
index 668d948..943a603 100644
--- a/.github/workflows/docs-build.yaml
+++ b/.github/workflows/docs-build.yaml
@@ -213,7 +213,7 @@ on:
         required: false
         type: string
         # yamllint disable-line rule:line-length
-        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@084d6861688632b2edb6bde3c180145bebf9cc7a'  # v0.17.2
+        default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@6d4a65c5601afd6c2fbe52bda4b0024b132f265d'  # v0.19.0
 
       # --- Timeouts ---
       docs_timeout_minutes:
@@ -413,7 +413,7 @@ jobs:
       - name: 'Checkout Gerrit change'
         if: inputs.gerrit_refspec != ''
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093  # v1.1.2
+        uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a  # v1.2.1
         with:
           gerrit-refspec: ${{ inputs.gerrit_refspec }}
           gerrit-project: ${{ inputs.gerrit_project }}
@@ -533,7 +533,7 @@ jobs:
       - name: 'Checkout Gerrit change'
         if: inputs.gerrit_refspec != ''
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093  # v1.1.2
+        uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a  # v1.2.1
         with:
           gerrit-refspec: ${{ inputs.gerrit_refspec }}
           gerrit-project: ${{ inputs.gerrit_project }}
@@ -607,7 +607,7 @@ jobs:
       - name: 'Checkout Gerrit change'
         if: inputs.gerrit_refspec != ''
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093  # v1.1.2
+        uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a  # v1.2.1
         with:
           gerrit-refspec: ${{ inputs.gerrit_refspec }}
           gerrit-project: ${{ inputs.gerrit_project }}
@@ -725,7 +725,7 @@ jobs:
 
       - name: 'Install uv'
         # yamllint disable-line rule:line-length
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
         with:
           # This job drives the ReadTheDocs API and never checks the
           # repository out. With an empty working directory there are no
diff --git a/.github/workflows/openssf-scorecard.yaml b/.github/workflows/openssf-scorecard.yaml
index 541ce5c..5d11a41 100644
--- a/.github/workflows/openssf-scorecard.yaml
+++ b/.github/workflows/openssf-scorecard.yaml
@@ -28,7 +28,7 @@ jobs:
   openssf-scorecard:
     name: "OpenSSF Scorecard"
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/openssf-scorecard.yaml@ef6c0d9930feedb274067703b50eeebe5ab859b3  # v0.9.5
+    uses: lfreleng-actions/security-workflows/.github/workflows/openssf-scorecard.yaml@378fcc19ebdf37f17fde4888d4b71c83b21d6cf3  # v0.9.7
     permissions:
       contents: read  # checkout
       security-events: write  # upload results to the code scanning dashboard
diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml
index c78401c..e378b77 100644
--- a/.github/workflows/release-drafter.yaml
+++ b/.github/workflows/release-drafter.yaml
@@ -30,7 +30,7 @@ jobs:
       # yamllint disable-line rule:line-length
       - uses: lfreleng-actions/harden-runner-block-action@e5e8179f45aa893b23cc8b5d2e25466355d9c4f8  # v0.14.0
         with:
-          config: '@084d6861688632b2edb6bde3c180145bebf9cc7a'  # v0.17.2
+          config: '@6d4a65c5601afd6c2fbe52bda4b0024b132f265d'  # v0.19.0
 
       # Harden the runner with the just-loaded allow-list.
       - name: 'Harden runner (block)'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b4483aa..fc1c03c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -42,4 +42,4 @@ jobs:
     permissions:
       contents: write  # Promote (publish) the draft release for the tag
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@9d4a5d5b7e30bcd26a0abffb5bf263fd11c13852  # v0.5.0
+    uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@04672a980550ff9bd89d24bacd39fb03e25b0b0b  # v0.6.1
diff --git a/docs/DOCS_WORKFLOWS_BRIEF.md b/docs/DOCS_WORKFLOWS_BRIEF.md
index aa39cd5..cba7234 100644
--- a/docs/DOCS_WORKFLOWS_BRIEF.md
+++ b/docs/DOCS_WORKFLOWS_BRIEF.md
@@ -718,7 +718,7 @@ The harden-runner pattern from `python-workflows` gives the target shape:
 
 ```yaml
 - name: 'Load harden-runner allow-list'
-  uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
+  uses: lfreleng-actions/harden-runner-block-action@e5e8179f45aa893b23cc8b5d2e25466355d9c4f8  # v0.14.0
   with:
     config: ${{ inputs.harden_runner_allowlist }}
 - name: 'Harden runner'
@@ -742,10 +742,10 @@ The allow-list default points at a pinned path in the organisation
 `.github` repository:
 
 ```text
-lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@18d9c4446bea555d0783e850f6d295f844fe8f67
+lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@6d4a65c5601afd6c2fbe52bda4b0024b132f265d
 ```
 
-That file holds 514 lines. A documentation pipeline reaches
+That file holds 796 lines. A documentation pipeline reaches
 `readthedocs.org`, PyPI and every host a project links to during
 `docs-linkcheck`, so the allow-list needs review before block mode goes
 live. Link checking against arbitrary hosts and egress blocking pull in
diff --git a/examples/docs-build/gerrit-merge.yaml b/examples/docs-build/gerrit-merge.yaml
index 3016615..a152d25 100644
--- a/examples/docs-build/gerrit-merge.yaml
+++ b/examples/docs-build/gerrit-merge.yaml
@@ -84,7 +84,7 @@ jobs:
           egress-policy: audit
       - name: 'Notify job start'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292  # v1.1.3
+        uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e  # v1.2.0
         with:
           host: ${{ vars.GERRIT_SERVER }}
           username: ${{ vars.GERRIT_SSH_USER }}
@@ -137,7 +137,7 @@ jobs:
         uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526  # v3.0.0
       - name: 'Report workflow conclusion'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292  # v1.1.3
+        uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e  # v1.2.0
         with:
           host: ${{ vars.GERRIT_SERVER }}
           username: ${{ vars.GERRIT_SSH_USER }}
diff --git a/examples/docs-build/gerrit.yaml b/examples/docs-build/gerrit.yaml
index 81eb0fc..e8288ba 100644
--- a/examples/docs-build/gerrit.yaml
+++ b/examples/docs-build/gerrit.yaml
@@ -104,7 +104,7 @@ jobs:
           egress-policy: audit
       - name: 'Clear votes'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292  # v1.1.3
+        uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e  # v1.2.0
         with:
           host: ${{ vars.GERRIT_SERVER }}
           username: ${{ vars.GERRIT_SSH_USER }}
@@ -168,7 +168,7 @@ jobs:
         uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526  # v3.0.0
       - name: 'Set vote'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292  # v1.1.3
+        uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e  # v1.2.0
         with:
           host: ${{ vars.GERRIT_SERVER }}
           username: ${{ vars.GERRIT_SSH_USER }}