diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4bc59c1..57793f30 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+            - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
               with:
                   cache: true
             - name: Lint
@@ -59,7 +59,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+            - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
               with:
                   runtime: node@${{ matrix.node-version }}
                   cache: true
@@ -92,7 +92,7 @@ jobs:
             - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
-            - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+            - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
               with:
                   cache: true
             - name: Pin ${{ matrix.name }}
@@ -138,7 +138,7 @@ jobs:
               with:
                   persist-credentials: false
             - name: Setup PHP
-              uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+              uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
               with:
                   php-version: ${{ matrix.php-version }}
                   tools: flex
@@ -200,7 +200,7 @@ jobs:
               with:
                   persist-credentials: false
             - name: Setup PHP
-              uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+              uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
               with:
                   php-version: '8.4'
                   tools: flex, symfony-cli
@@ -211,7 +211,7 @@ jobs:
                   dependency-versions: highest
                   composer-options: --prefer-dist
                   custom-cache-suffix: ${{ matrix.symfony-version }}
-            - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+            - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
               with:
                   cache: true
             - name: Pin ${{ matrix.name }}
@@ -230,7 +230,7 @@ jobs:
               run: pnpm -C playground run test:e2e
             - name: Upload Playwright artifacts
               if: failure()
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: e2e-artifacts-${{ matrix.id }}
                   path: playground/tests/e2e/artifacts/
@@ -246,7 +246,7 @@ jobs:
               with:
                   persist-credentials: false
             - name: Setup PHP
-              uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+              uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
               with:
                   php-version: '8.4'
                   tools: composer:v2
diff --git a/.github/workflows/release-on-npm.yaml b/.github/workflows/release-on-npm.yaml
index 15cdcba7..90dbeade 100644
--- a/.github/workflows/release-on-npm.yaml
+++ b/.github/workflows/release-on-npm.yaml
@@ -33,14 +33,14 @@ jobs:
                   fi
                   echo "Tag ${GITHUB_REF_NAME} verified as ancestor of main."
 
-            - uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+            - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
 
               # setup-node is kept here only for its `registry-url` input, which is what wires
               # npm OIDC trusted publishing. It gets no `node-version`, so it installs nothing:
               # pnpm/setup already provisioned Node from `devEngines.runtime`.
               # setup-node does not enable any package-manager cache here (no `cache:` input),
               # so cache poisoning is not a concern on this release workflow.
-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # zizmor: ignore[cache-poisoning] v7.0.0
+            - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # zizmor: ignore[cache-poisoning] v7.1.0
               with:
                   registry-url: 'https://registry.npmjs.org'
 
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 97381220..8522c883 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -28,4 +28,4 @@ jobs:
               with:
                   persist-credentials: false
             - name: Run Zizmor
-              uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+              uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1