diff --git a/.github/workflows/pr-check-managed-files-hosted.yml b/.github/workflows/pr-check-managed-files-hosted.yml
index 5269605..01113f3 100644
--- a/.github/workflows/pr-check-managed-files-hosted.yml
+++ b/.github/workflows/pr-check-managed-files-hosted.yml
@@ -112,7 +112,7 @@ jobs:
         # now contains that commit, so the pin-comment takes the convention's
         # release-tag form rather than the short-SHA fallback
         # (components/managed-files-guard/README.md).
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@96b50d451c4483c476f2f963674e0a3ba9d50fe3 # v0.48.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read
diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index 3ef8815..279b136 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -81,7 +81,7 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@96b50d451c4483c476f2f963674e0a3ba9d50fe3 # v0.48.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0
     with:
       runner: ubuntu-24.04
       # Bot senders this lane reviews, by numeric user id: the
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 92ef858..f559ebe 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -74,7 +74,7 @@ jobs:
                              # the lane's reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@96b50d451c4483c476f2f963674e0a3ba9d50fe3 # v0.48.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@7b362428c76085a160e28656cd2c75c3147a69ff # v0.54.0
     with:
       runner: ubuntu-24.04
       # Bot senders this lane reviews, by numeric user id: the