diff --git a/.github/actions/binding-tools/action.yml b/.github/actions/binding-tools/action.yml
index 5f5f243..b2684f1 100644
--- a/.github/actions/binding-tools/action.yml
+++ b/.github/actions/binding-tools/action.yml
@@ -38,7 +38,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: '3.12.10'
     - name: Install helper dependency
@@ -61,7 +61,7 @@ runs:
           python tooling/extension-bindings/ci/generate-python.py configure --targets "$INPUT_TARGETS"
           python tooling/extension-bindings/ci/generate-typescript.py configure --targets "$INPUT_TARGETS"
         fi
-    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ steps.configure.outputs.go-version }}
         cache-dependency-path: |
@@ -119,7 +119,7 @@ runs:
         } >> "$GITHUB_ENV"
     - name: Set up the pinned Node.js
       if: steps.configure.outputs.has-typescript == 'true'
-      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ steps.configure.outputs.typescript-version }}
         cache: npm
diff --git a/.github/workflows/binding-generate.yml b/.github/workflows/binding-generate.yml
index de320ef..2a6f9f6 100644
--- a/.github/workflows/binding-generate.yml
+++ b/.github/workflows/binding-generate.yml
@@ -46,7 +46,7 @@ jobs:
       GOTOOLCHAIN: local
     steps:
       - name: Check out current main
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           persist-credentials: true
@@ -96,7 +96,7 @@ jobs:
         run: python tooling/extension-bindings/ci/generation.py commit --targets "$INPUT_TARGETS" --source-commit "$SOURCE_COMMIT"
 
       - name: Publish updated discovery pages through the existing docs build
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.DOCS_REPO_DISPATCH_TOKEN }}
           repository: runtimeconditions/runtimeconditions.github.io
diff --git a/.github/workflows/binding-promote.yml b/.github/workflows/binding-promote.yml
index 82d2d13..9be3c1f 100644
--- a/.github/workflows/binding-promote.yml
+++ b/.github/workflows/binding-promote.yml
@@ -32,7 +32,7 @@ jobs:
       GOTOOLCHAIN: local
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
@@ -53,7 +53,7 @@ jobs:
         run: |
           python tooling/extension-bindings/ci/publish.py build --targets "$TARGETS" \
             --rc "$RC" --core-schema "$CORE_SCHEMA" --output "$RUNNER_TEMP/go-binding-assets"
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: go-binding-assets
           path: ${{ runner.temp }}/go-binding-assets
@@ -72,17 +72,17 @@ jobs:
       DRY_RUN: ${{ inputs.dry_run }}
       GOTOOLCHAIN: local
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.build.outputs.source_commit }}
           fetch-depth: 0
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12.10'
       - run: |
           printf 'PYTHONPYCACHEPREFIX=%s\n' "$RUNNER_TEMP/python-bytecode" >> "$GITHUB_ENV"
           python -m pip install --disable-pip-version-check PyYAML==6.0.3
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: go-binding-assets
           path: ${{ runner.temp }}/go-binding-assets
@@ -93,7 +93,7 @@ jobs:
           if [[ "$DRY_RUN" == true ]]; then args+=(--dry-run); fi
           python tooling/extension-bindings/ci/publish.py promote --targets "$TARGETS" \
             --output "$RUNNER_TEMP/go-binding-assets" "${args[@]}"
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: ${{ !inputs.dry_run }}
         with:
           go-version: ${{ needs.build.outputs.go_version }}
diff --git a/.github/workflows/binding-publish-npm.yml b/.github/workflows/binding-publish-npm.yml
index daa24f2..7075526 100644
--- a/.github/workflows/binding-publish-npm.yml
+++ b/.github/workflows/binding-publish-npm.yml
@@ -34,12 +34,12 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python for the publication helper
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12.10'
 
@@ -47,7 +47,7 @@ jobs:
         run: python -m pip install --disable-pip-version-check PyYAML==6.0.3
 
       - name: Set up Node.js for npm trusted publishing
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24.11.0'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/check-extensions-site-builds.yml b/.github/workflows/check-extensions-site-builds.yml
index a821c35..a7b0ca5 100644
--- a/.github/workflows/check-extensions-site-builds.yml
+++ b/.github/workflows/check-extensions-site-builds.yml
@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/enforce-kind-namespacing.yml b/.github/workflows/enforce-kind-namespacing.yml
index 96b0c74..1673841 100644
--- a/.github/workflows/enforce-kind-namespacing.yml
+++ b/.github/workflows/enforce-kind-namespacing.yml
@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/extension-binding-normalizer.yml b/.github/workflows/extension-binding-normalizer.yml
index ec2228d..6698754 100644
--- a/.github/workflows/extension-binding-normalizer.yml
+++ b/.github/workflows/extension-binding-normalizer.yml
@@ -39,12 +39,12 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tooling/extension-bindings/normalizer/go.mod
           cache-dependency-path: tooling/extension-bindings/normalizer/go.sum
@@ -66,12 +66,12 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tooling/extension-bindings/emitters/go/go.mod
           cache-dependency-path: |
@@ -95,12 +95,12 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 20.19.6
           cache: npm
diff --git a/.github/workflows/notify-docs-site.yml b/.github/workflows/notify-docs-site.yml
index 3b56350..3809ad3 100644
--- a/.github/workflows/notify-docs-site.yml
+++ b/.github/workflows/notify-docs-site.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Trigger docs site rebuild
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.DOCS_REPO_DISPATCH_TOKEN }}
           repository: runtimeconditions/runtimeconditions.github.io
diff --git a/.github/workflows/smithy-maintenance.yml b/.github/workflows/smithy-maintenance.yml
index 41c1a76..2057b01 100644
--- a/.github/workflows/smithy-maintenance.yml
+++ b/.github/workflows/smithy-maintenance.yml
@@ -31,12 +31,12 @@ jobs:
 
     steps:
       - name: Check out extension semantics
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: extensions
 
       - name: Check out authoritative AWS API models
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: aws/api-models-aws
           path: api-models-aws
@@ -45,7 +45,7 @@ jobs:
           sparse-checkout: models/s3
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c88b229..d5d0706 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,12 +19,12 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check out the service operations inventories next to the repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: runtimeconditions/service-operations-inventories
           ref: 3778830d2e3c025eec90750109e4999d47dad4d2
@@ -35,7 +35,7 @@ jobs:
         run: ln -s "$PWD/service-operations-inventories" "$(dirname "$PWD")/service-operations-inventories"
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12.10'
 
@@ -70,12 +70,12 @@ jobs:
         working-directory: tooling/extension-bindings/orchestrator
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tooling/extension-bindings/orchestrator/go.mod
           cache-dependency-path: |