diff --git a/.github/actions/download-artifact/action.yml b/.github/actions/download-artifact/action.yml
index 862030a6a..1524ffec7 100644
--- a/.github/actions/download-artifact/action.yml
+++ b/.github/actions/download-artifact/action.yml
@@ -18,15 +18,16 @@ inputs:
 runs:
   using: composite
   steps:
-    # download-artifact v4 can finish "successfully" with a truncated file:
-    # run 38059192473 attempt 1 logged "Starting download" and nothing more,
+    # download-artifact can finish "successfully" with a truncated file.
+    # Seen on v4; keep the check on newer majors too: run
+    # 38059192473 attempt 1 logged "Starting download" and nothing more,
     # then `zstd -d` failed with "Read error (39) : premature end" in the
     # next step and the leg went red. A merge-queue leg that does that
     # evicts the entry, so check the files and fetch them once more.
     - name: Download (attempt 1)
       id: first
       if: ${{ !cancelled() }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       continue-on-error: true
       with:
         pattern: ${{ inputs.pattern }}
@@ -58,7 +59,7 @@ runs:
     - name: Download (attempt 2)
       id: second
       if: ${{ !cancelled() && (steps.first.outcome == 'failure' || steps.first-check.outcome == 'failure') }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         pattern: ${{ inputs.pattern }}
         merge-multiple: ${{ inputs.merge-multiple }}
diff --git a/.github/actions/upload-artifact/action.yml b/.github/actions/upload-artifact/action.yml
index 96d80ecea..527112b92 100644
--- a/.github/actions/upload-artifact/action.yml
+++ b/.github/actions/upload-artifact/action.yml
@@ -42,7 +42,7 @@ runs:
     - name: Upload (attempt 1)
       id: first
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       continue-on-error: true
       with:
         name: ${{ inputs.name }}
@@ -61,7 +61,7 @@ runs:
     - name: Upload (attempt 2)
       id: second
       if: ${{ !cancelled() && steps.first.outcome == 'failure' }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       continue-on-error: true
       with:
         name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-2
@@ -82,7 +82,7 @@ runs:
     - name: Upload (attempt 3)
       id: third
       if: ${{ !cancelled() && steps.second.outcome == 'failure' }}
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: ${{ inputs.name }}-retry-${{ github.run_attempt }}-3
         path: ${{ inputs.path }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b576932a4..eef9a64dd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -178,7 +178,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.20.2'
 
@@ -810,7 +810,7 @@ jobs:
       # binary we mount into the container).
 
       - name: Download base image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           pattern: docker-base-image*
           merge-multiple: true
@@ -909,7 +909,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y lcov
 
       - name: Download all coverage artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           path: coverage-artifacts
           pattern: coverage-{host*,docker-*}
@@ -967,7 +967,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.20.2'
 
@@ -1402,7 +1402,7 @@ jobs:
 
       - name: Setup Node.js
         if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan' || matrix.suite == 'e2e_safety_pnpm'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.20.2'
 
@@ -1417,13 +1417,13 @@ jobs:
 
       - name: Setup Node.js 24 (named pnpm legs)
         if: matrix.suite == 'e2e_redirect_pnpm_build'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24.x'
 
       - name: Setup Python
         if: matrix.suite == 'e2e_pypi' || matrix.uv != '' || matrix.poetry != '' || matrix.pdm != '' || matrix.hatch != ''
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12.x'
 
@@ -1464,7 +1464,7 @@ jobs:
 
       - name: Setup uv (Pipenv / pip legs)
         if: matrix.pipenv != '' || matrix.pip != ''
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        uses: astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c # v7.0.0
 
       - name: Install the Pythons the Pipenv / pip legs run on
         if: matrix.pipenv != '' || matrix.pip != ''
@@ -1661,7 +1661,7 @@ jobs:
 
       - name: Setup Node.js 24 (vlt legs)
         if: matrix.vlt != ''
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24.21.0'
 
@@ -2151,7 +2151,7 @@ jobs:
       # images and would be flagged by zizmor's cache-poisoning audit.
 
       - name: Download base image
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           pattern: docker-base-image*
           merge-multiple: true
@@ -2230,7 +2230,7 @@ jobs:
           shared-key: dev-ubuntu-latest
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24.x'
       - name: Manifest-less VEX over every real yarn classic flow
@@ -2620,7 +2620,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           # Node 24, NOT the 20.20.2 the other jobs pin. pnpm 10 imports
           # `node:sqlite` for its store index, which does not exist before
@@ -2671,7 +2671,7 @@ jobs:
 
       - name: Setup Python + uv
         if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12.x'