diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bfabdc7..ed99822 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,10 +31,10 @@ jobs:
       # Verify gradle-wrapper.jar matches a known-good Gradle release checksum before it
       # is executed — guards against a tampered wrapper jar (a classic build-time backdoor).
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       # The persistence integration suites self-skip when PKAUTH_SKIP_TESTCONTAINERS=1. The CI
       # gate must exercise them against real Postgres/DynamoDB Local, so fail loudly if that
@@ -87,7 +87,7 @@ jobs:
         # runs — skip in both cases so the scan doesn't hard-fail without a token. Manual
         # (workflow_dispatch) and push runs always have the secret available.
         if: github.actor != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: sonarsource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        uses: sonarsource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
@@ -160,10 +160,10 @@ jobs:
       # The e2eTest task executes the wrapper jar (directly and again nested, when Playwright boots
       # the demo via the Gradle `run` task) — validate it for the same reason the build job does.
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/wrapper-validation@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Run ${{ matrix.demo }} e2e
         run: ./gradlew :examples:${{ matrix.demo }}:e2eTest --stacktrace
diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml
index 4cac613..40c4a47 100644
--- a/.github/workflows/manual-release.yml
+++ b/.github/workflows/manual-release.yml
@@ -62,7 +62,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Verify version matches tag
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 09db8f2..68cd432 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Verify version matches tag
         run: |