diff --git a/.github/workflows/glean-probe-scraper.yml b/.github/workflows/glean-probe-scraper.yml
index cfc22261..9fcff83e 100644
--- a/.github/workflows/glean-probe-scraper.yml
+++ b/.github/workflows/glean-probe-scraper.yml
@@ -17,4 +17,4 @@ jobs:
     permissions:
       contents: read
       checks: write
-    uses: mozilla/probe-scraper/.github/workflows/glean.yaml@78f5c5f20dfca6bcb68138a1122dae5acfd06605 # v1.0
+    uses: mozilla/probe-scraper/.github/workflows/glean.yaml@b09ce7ac027f0f85c690bbfddbcac071c9a3d223 # v1.0
diff --git a/.github/workflows/main-workflow.yml b/.github/workflows/main-workflow.yml
index 60585bdb..bf033ed4 100644
--- a/.github/workflows/main-workflow.yml
+++ b/.github/workflows/main-workflow.yml
@@ -46,7 +46,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Cache pip and Poetry virtualenv
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip
@@ -71,7 +71,7 @@ jobs:
     steps:
       - name: Cache Rust toolchain
         id: cache-rust-toolchain
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.rustup/toolchains
@@ -106,7 +106,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Restore pip and Poetry virtualenv
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip
@@ -133,7 +133,7 @@ jobs:
           persist-credentials: false
 
       - name: Restore Rust toolchain
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.rustup/toolchains
@@ -145,7 +145,7 @@ jobs:
 
       - name: Cache cargo-audit
         id: cache-cargo-audit
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-audit
           key: ${{ runner.os }}-cargo-audit-${{ hashFiles('.github/workflows/main-workflow.yml') }}
@@ -156,7 +156,7 @@ jobs:
 
       - name: Cache mdbook
         id: cache-mdbook
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cargo/bin/mdbook
@@ -190,7 +190,7 @@ jobs:
           persist-credentials: false
 
       - name: Restore Rust toolchain
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.rustup/toolchains
@@ -240,7 +240,7 @@ jobs:
           persist-credentials: false
 
       - name: Restore Rust toolchain
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.rustup/toolchains
@@ -251,7 +251,7 @@ jobs:
         run: rustup default ${{ env.RUST_VERSION }}
 
       - name: Restore pip and Poetry virtualenv
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip
@@ -259,7 +259,7 @@ jobs:
           key: ${{ runner.os }}-python-${{ hashFiles('pyproject.toml', 'poetry.lock') }}
 
       - name: Cache Cargo build artifacts
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -294,7 +294,7 @@ jobs:
 
       - name: Cache cargo-nextest
         id: cache-cargo-nextest-postgres
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-nextest
           key: ${{ runner.os }}-cargo-nextest-${{ hashFiles('**/Cargo.lock') }}
@@ -305,7 +305,7 @@ jobs:
 
       - name: Cache cargo-llvm-cov
         id: cache-cargo-llvm-cov-postgres
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-llvm-cov
           key: ${{ runner.os }}-cargo-llvm-cov-${{ hashFiles('**/Cargo.lock') }}
@@ -335,7 +335,7 @@ jobs:
           SYNC_SYNCSTORAGE__DATABASE_URL: postgresql://test:test@127.0.0.1/syncstorage
 
       - name: Publish Test Report
-        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
+        uses: dorny/test-reporter@ab50174d2cce6a041bb0a86aa99d11858f914df9
         if: always()
         with:
           name: Postgres Unit Tests
@@ -345,7 +345,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: postgres-test-results
           path: workflow/test-results/
@@ -359,7 +359,7 @@ jobs:
 
       - name: Upload JUnit results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
@@ -369,7 +369,7 @@ jobs:
 
       - name: Upload coverage results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/coverage
@@ -403,7 +403,7 @@ jobs:
 
       - name: Cache Docker image tar
         id: cache-postgres-image
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: /tmp/postgres-image.tar
           key: ${{ runner.os }}-postgres-image-${{ hashFiles('Dockerfile', 'Cargo.lock', '**/*.rs', '**/Cargo.toml', 'tools/**', 'scripts/**') }}
@@ -427,7 +427,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: postgres-docker-image
           path: /tmp/postgres-image.tar
@@ -446,7 +446,7 @@ jobs:
           persist-credentials: false
 
       - name: Download Docker image
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: postgres-docker-image
           path: /tmp
@@ -463,7 +463,7 @@ jobs:
           SYNCSTORAGE_RS_IMAGE: app:build
 
       - name: Publish E2E Test Report
-        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
+        uses: dorny/test-reporter@ab50174d2cce6a041bb0a86aa99d11858f914df9
         if: always()
         with:
           name: Postgres E2E Tests
@@ -473,7 +473,7 @@ jobs:
 
       - name: Upload e2e test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: postgres-e2e-test-results
           path: workflow/test-results/
@@ -487,7 +487,7 @@ jobs:
 
       - name: Upload e2e test results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
@@ -533,7 +533,7 @@ jobs:
           persist-credentials: false
 
       - name: Restore Rust toolchain
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.rustup/toolchains
@@ -544,7 +544,7 @@ jobs:
         run: rustup default ${{ env.RUST_VERSION }}
 
       - name: Restore pip and Poetry virtualenv
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip
@@ -552,7 +552,7 @@ jobs:
           key: ${{ runner.os }}-python-${{ hashFiles('pyproject.toml', 'poetry.lock') }}
 
       - name: Cache Cargo build artifacts
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -588,7 +588,7 @@ jobs:
 
       - name: Cache cargo-nextest
         id: cache-cargo-nextest-mysql
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-nextest
           key: ${{ runner.os }}-cargo-nextest-${{ hashFiles('**/Cargo.lock') }}
@@ -599,7 +599,7 @@ jobs:
 
       - name: Cache cargo-llvm-cov
         id: cache-cargo-llvm-cov-mysql
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-llvm-cov
           key: ${{ runner.os }}-cargo-llvm-cov-${{ hashFiles('**/Cargo.lock') }}
@@ -617,7 +617,7 @@ jobs:
           SYNC_SYNCSTORAGE__ENFORCE_QUOTA: 1
 
       - name: Publish Test Report
-        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
+        uses: dorny/test-reporter@ab50174d2cce6a041bb0a86aa99d11858f914df9
         if: always()
         with:
           name: MySQL Unit Tests
@@ -627,7 +627,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: mysql-test-results
           path: workflow/test-results/
@@ -641,7 +641,7 @@ jobs:
 
       - name: Upload JUnit results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
@@ -651,7 +651,7 @@ jobs:
 
       - name: Upload coverage results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/coverage
@@ -686,7 +686,7 @@ jobs:
 
       - name: Cache Docker image tar
         id: cache-mysql-image
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: /tmp/mysql-image.tar
           key: ${{ runner.os }}-mysql-image-${{ hashFiles('Dockerfile', 'Cargo.lock', '**/*.rs', '**/Cargo.toml', 'tools/**', 'scripts/**') }}
@@ -710,7 +710,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: mysql-docker-image
           path: /tmp/mysql-image.tar
@@ -729,7 +729,7 @@ jobs:
           persist-credentials: false
 
       - name: Download Docker image
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: mysql-docker-image
           path: /tmp
@@ -746,7 +746,7 @@ jobs:
           SYNCSTORAGE_RS_IMAGE: app:build
 
       - name: Publish E2E Test Report
-        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
+        uses: dorny/test-reporter@ab50174d2cce6a041bb0a86aa99d11858f914df9
         if: always()
         with:
           name: MySQL E2E Tests
@@ -756,7 +756,7 @@ jobs:
 
       - name: Upload e2e test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: mysql-e2e-test-results
           path: workflow/test-results/
@@ -770,7 +770,7 @@ jobs:
 
       - name: Upload e2e test results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
@@ -821,7 +821,7 @@ jobs:
           persist-credentials: false
 
       - name: Restore Rust toolchain
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.rustup/toolchains
@@ -832,7 +832,7 @@ jobs:
         run: rustup default ${{ env.RUST_VERSION }}
 
       - name: Restore pip and Poetry virtualenv
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip
@@ -840,7 +840,7 @@ jobs:
           key: ${{ runner.os }}-python-${{ hashFiles('pyproject.toml', 'poetry.lock') }}
 
       - name: Cache Cargo build artifacts
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -868,7 +868,7 @@ jobs:
 
       - name: Cache cargo-nextest
         id: cache-cargo-nextest-spanner
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-nextest
           key: ${{ runner.os }}-cargo-nextest-${{ hashFiles('**/Cargo.lock') }}
@@ -879,7 +879,7 @@ jobs:
 
       - name: Cache cargo-llvm-cov
         id: cache-cargo-llvm-cov-spanner
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cargo/bin/cargo-llvm-cov
           key: ${{ runner.os }}-cargo-llvm-cov-${{ hashFiles('**/Cargo.lock') }}
@@ -934,7 +934,7 @@ jobs:
         run: make spanner_test_with_coverage
 
       - name: Publish Test Report
-        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
+        uses: dorny/test-reporter@ab50174d2cce6a041bb0a86aa99d11858f914df9
         if: always()
         with:
           name: Spanner Unit Tests
@@ -944,7 +944,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: spanner-test-results
           path: workflow/test-results/
@@ -958,7 +958,7 @@ jobs:
 
       - name: Upload JUnit results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
@@ -968,7 +968,7 @@ jobs:
 
       - name: Upload coverage results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/coverage
@@ -1003,7 +1003,7 @@ jobs:
 
       - name: Cache Docker image tar
         id: cache-spanner-image
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: /tmp/spanner-image.tar
           key: ${{ runner.os }}-spanner-image-${{ hashFiles('Dockerfile', 'Cargo.lock', '**/*.rs', '**/Cargo.toml', 'tools/**', 'scripts/**') }}
@@ -1027,7 +1027,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Upload Docker image artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: spanner-docker-image
           path: /tmp/spanner-image.tar
@@ -1047,7 +1047,7 @@ jobs:
           persist-credentials: false
 
       - name: Download Docker image
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: spanner-docker-image
           path: /tmp
@@ -1064,7 +1064,7 @@ jobs:
           SYNCSTORAGE_RS_IMAGE: app:build
 
       - name: Publish E2E Test Report
-        uses: dorny/test-reporter@a810f9bf83f2344124a920a7a0a85a6716e791f0
+        uses: dorny/test-reporter@ab50174d2cce6a041bb0a86aa99d11858f914df9
         if: always()
         with:
           name: Spanner E2E Tests
@@ -1074,7 +1074,7 @@ jobs:
 
       - name: Upload e2e test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: spanner-e2e-test-results
           path: workflow/test-results/
@@ -1088,7 +1088,7 @@ jobs:
 
       - name: Upload e2e test results to GCS
         if: github.ref == 'refs/heads/master'
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         with:
           path: workflow/test-results
           destination: ecosystem-test-eng-metrics/syncstorage-rs/junit
diff --git a/.github/workflows/mozcloud-publish.yaml b/.github/workflows/mozcloud-publish.yaml
index dea55f08..7df4547a 100644
--- a/.github/workflows/mozcloud-publish.yaml
+++ b/.github/workflows/mozcloud-publish.yaml
@@ -135,7 +135,7 @@ jobs:
           token_format: access_token
 
       - name: Log in to enterprise GAR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: us-docker.pkg.dev
           username: oauth2accesstoken
@@ -264,7 +264,7 @@ jobs:
           token_format: access_token
 
       - name: Log in to enterprise GAR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: us-docker.pkg.dev
           username: oauth2accesstoken
diff --git a/.github/workflows/publish-docs.yaml b/.github/workflows/publish-docs.yaml
index 583061e4..e0323757 100644
--- a/.github/workflows/publish-docs.yaml
+++ b/.github/workflows/publish-docs.yaml
@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cargo/bin/
@@ -49,7 +49,7 @@ jobs:
           cargo doc --no-deps
           cp -r ../target/doc/* output/api
       - name: Upload mdBook artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: mdbook-output
           path: ./docs/output
@@ -61,7 +61,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cargo/bin/
@@ -94,7 +94,7 @@ jobs:
 
           echo "Swagger UI setup complete!"
       - name: Upload Swagger UI artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: swagger-ui-output
           path: ./swagger-ui-dist
@@ -105,12 +105,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download mdBook artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: mdbook-output
           path: ./output
       - name: Download Swagger UI artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: swagger-ui-output
           path: ./output/swagger-ui
@@ -144,7 +144,7 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
       - name: Print deployed docs URL
         run: |
           echo "Documentation deployed successfully."