diff --git a/.github/actions/biome/action.yml b/.github/actions/biome/action.yml
index 57cb203..eb0995f 100644
--- a/.github/actions/biome/action.yml
+++ b/.github/actions/biome/action.yml
@@ -25,7 +25,7 @@ inputs:
     description: >-
       Reviewed default when version is empty and the caller has no exact
       `@biomejs/biome` pin. Drift-check monitors this input only.
-    default: 2.5.9
+    default: 2.5.10
   node-version:
     description: Node.js version to set up.
     default: 24.19.0
diff --git a/.github/actions/editorconfig/action.yml b/.github/actions/editorconfig/action.yml
index fc66cad..ac7cc87 100644
--- a/.github/actions/editorconfig/action.yml
+++ b/.github/actions/editorconfig/action.yml
@@ -31,12 +31,12 @@ inputs:
     default: ''
   version:
     description: Exact editorconfig-checker version to install.
-    default: 3.11.1
+    default: 3.11.2
   sha256:
     description: >-
       SHA-256 of the ec-linux-amd64.tar.gz release asset for `version`. Change
       together with `version`.
-    default: 5a37922963248451e88149251e49f6ae08f69717a3918202a51fe9945e19691e
+    default: bc815e5b3b1891a0ee9e1242fe3475312655f8b0f4c4a79510be0a009294571a
 
 runs:
   using: composite
diff --git a/.github/actions/lefthook-validate/action.yml b/.github/actions/lefthook-validate/action.yml
index 47f69ae..ad22516 100644
--- a/.github/actions/lefthook-validate/action.yml
+++ b/.github/actions/lefthook-validate/action.yml
@@ -12,12 +12,12 @@ inputs:
     description: >-
       Exact Lefthook version to install. Keep this aligned with the version
       used by the standards-managed consumer toolchain.
-    default: 2.1.10
+    default: 2.1.11
   sha256:
     description: >-
       SHA-256 of the Linux_x86_64 release binary for `version`. Change
       together with `version`.
-    default: f1de34ea0572363a525a2000d40f5a646733893ad28c924b34ac98304518073f
+    default: 9012055ae53e2c4de81b53d0e37d9bea19fc294a5dab86ce5ed62609ad9f0622
 
 runs:
   using: composite
diff --git a/.github/scripts/resolve-npm-tool-version.test.cjs b/.github/scripts/resolve-npm-tool-version.test.cjs
index c5013a4..4a95065 100644
--- a/.github/scripts/resolve-npm-tool-version.test.cjs
+++ b/.github/scripts/resolve-npm-tool-version.test.cjs
@@ -138,7 +138,7 @@ test("biome action wires resolve step before npx", () => {
     "utf8",
   );
   assert.match(action, /^ {2}fallback-version:/mu);
-  assert.match(action, /^ {4}default: 2\.5\.9$/mu);
+  assert.match(action, /^ {4}default: 2\.5\.10$/mu);
   assert.match(action, /resolve-npm-tool-version\.cjs/u);
   assert.match(action, /PACKAGE_NAME: '@biomejs\/biome'/u);
   assert.match(