diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml
index 318a448..5d42e5b 100644
--- a/.github/workflows/claim-sweep.yml
+++ b/.github/workflows/claim-sweep.yml
@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@14c1a9b3ade8bb6416f46c890eda21823647da09
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index e6a0543..b634ae3 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -53,6 +53,6 @@ jobs:
   osv:
     # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a
     # reviewer can tell an intentional bump from a drifted one.
-    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@30978ba6776c30081379e23fa20a12f36db3a48c # main
+    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@fb7ca62fd9fb8af90af1097a0b21ee703c103dc4 # main
     with:
       report-only: true # adoption grace — delete this once findings are clear (ci-workflows#2)
diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml
index 4934806..b9a8f22 100644
--- a/.github/workflows/front-desk-add.yml
+++ b/.github/workflows/front-desk-add.yml
@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@99e88a0335519cb78be8a1b6623105613fa6aca1 # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445 # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}
diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml
index 65c6008..ec390da 100644
--- a/.github/workflows/pr-claim.yml
+++ b/.github/workflows/pr-claim.yml
@@ -53,4 +53,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@8a56f22f32bd007affbef503a4f1ac736c9aa52d
\ No newline at end of file
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445
\ No newline at end of file
diff --git a/.github/workflows/publish-jsr.yml b/.github/workflows/publish-jsr.yml
index 4af3ef1..a530a7f 100644
--- a/.github/workflows/publish-jsr.yml
+++ b/.github/workflows/publish-jsr.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f6be1bc..abe2592 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,6 @@ permissions:
 
 jobs:
   release:
-    uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.5.0 # mint
+    uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.8.0 # mint
     with:
       ref: v0.3.1
diff --git a/.github/workflows/standard.yml b/.github/workflows/standard.yml
index f387aab..9f647fb 100644
--- a/.github/workflows/standard.yml
+++ b/.github/workflows/standard.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   standard:
-    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@99e88a0335519cb78be8a1b6623105613fa6aca1
+    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445
     with:
       security: true
       test: true
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 8d324ec..d662975 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -13,6 +13,6 @@ permissions:
 
 jobs:
   version:
-    uses: bounded-systems/mint/.github/workflows/version.yml@v0.5.0 # mint
+    uses: bounded-systems/mint/.github/workflows/version.yml@v0.8.0 # mint
     with:
       ref: v0.3.1