diff --git a/.github/actions/check-jsonschema/action.yml b/.github/actions/check-jsonschema/action.yml
index d23ffb4a..6aa54925 100644
--- a/.github/actions/check-jsonschema/action.yml
+++ b/.github/actions/check-jsonschema/action.yml
@@ -45,7 +45,7 @@ runs:
   using: composite
   steps:
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ inputs.python-version }}
 
diff --git a/.github/actions/pyright/action.yml b/.github/actions/pyright/action.yml
index 79ae1a2c..d920b03d 100644
--- a/.github/actions/pyright/action.yml
+++ b/.github/actions/pyright/action.yml
@@ -33,7 +33,7 @@ runs:
   using: composite
   steps:
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ inputs.python-version }}
 
diff --git a/.github/actions/ruff/action.yml b/.github/actions/ruff/action.yml
index e0ef2eb6..3e2e96c2 100644
--- a/.github/actions/ruff/action.yml
+++ b/.github/actions/ruff/action.yml
@@ -29,7 +29,7 @@ runs:
   using: composite
   steps:
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ inputs.python-version }}
 
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 19c56226..8fb7274d 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -571,7 +571,7 @@ jobs:
       contents: read
       pull-requests: write
       id-token: write
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -581,7 +581,7 @@ jobs:
       contents: read
       pull-requests: write
       id-token: write
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -591,7 +591,7 @@ jobs:
     if: ${{ github.event_name == 'issues' }}
     permissions:
       issues: write
-    uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1
 
   # Arms auto-merge on this repo's vendor Dependabot bumps, pinned so a bump
   # cannot redefine the code holding the write token. Never in `ci-status`:
@@ -601,7 +601,7 @@ jobs:
     permissions:
       contents: write # enablePullRequestAutoMerge
       pull-requests: write # Arm or disarm auto-merge; list the PR's commits.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@4cfd14e8b6f8b740f5f0af27f80139a0d40a596d # v0.42.1
     with:
       runner: ubuntu-24.04