diff --git a/.github/workflows/agents-md-integrity.yml b/.github/workflows/agents-md-integrity.yml
index e020dea9..02fb9a23 100644
--- a/.github/workflows/agents-md-integrity.yml
+++ b/.github/workflows/agents-md-integrity.yml
@@ -16,6 +16,6 @@ jobs:
   agents-md:
     permissions:
       contents: read
-    uses: Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml@c6b3effa6d2e9fff97500d9688b54106f556c433 # github-workflows main (c6b3eff)
+    uses: Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml@425c154ce5049324ee23ad10e106baeed4cfa31b # github-workflows main (c6b3eff)
     with:
       workflows_ref: c6b3effa6d2e9fff97500d9688b54106f556c433
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 0f5da884..366047fa 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/groom.yml b/.github/workflows/groom.yml
index 61e6ef70..92ef83e6 100644
--- a/.github/workflows/groom.yml
+++ b/.github/workflows/groom.yml
@@ -87,7 +87,7 @@ jobs:
       # Omitting it rejects the run outright ("requesting 'actions: read', but is
       # only allowed 'actions: none'").
       actions: read
-    uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@4efe4c559b37339a22ae3547aa108f95d1ea4aca # main @ 4efe4c5
+    uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@425c154ce5049324ee23ad10e106baeed4cfa31b # main @ 4efe4c5
     with:
       # File as cloud-code-bot (App token) rather than github-actions[bot]. Absent
       # APP_ID degrades to github-actions[bot] instead of failing.
diff --git a/.github/workflows/public-repo-hygiene.yml b/.github/workflows/public-repo-hygiene.yml
index e809d9df..6cb05bd5 100644
--- a/.github/workflows/public-repo-hygiene.yml
+++ b/.github/workflows/public-repo-hygiene.yml
@@ -22,7 +22,7 @@ jobs:
   hygiene:
     permissions:
       contents: read
-    uses: Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml@3b2c8ca1f52056b54453a659fdb4473cfc88aa0e # github-workflows main (3b2c8ca)
+    uses: Comfy-Org/github-workflows/.github/workflows/public-repo-hygiene.yml@425c154ce5049324ee23ad10e106baeed4cfa31b # github-workflows main (3b2c8ca)
     with:
       # REQUIRED, and must equal the `uses:` SHA above — the reusable asserts
       # they match, which is what pins the checker to the reviewed commit.
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 6ad41444..bc37b3f7 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           python-version: '3.10'  # Follow the min version in pyproject.toml
diff --git a/.github/workflows/refresh-cql-catalogs.yml b/.github/workflows/refresh-cql-catalogs.yml
index 0fd4dc8b..c3eea8c7 100644
--- a/.github/workflows/refresh-cql-catalogs.yml
+++ b/.github/workflows/refresh-cql-catalogs.yml
@@ -74,7 +74,7 @@ jobs:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Persist the app token (not the default GITHUB_TOKEN) as the credential
           # for `origin` so the later force-push is authored by the bot and fires
@@ -131,7 +131,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: '3.10'  # Follow the min version in pyproject.toml